SUSE-SU-2021:3322-1 Security update for xen

This update for xen fixes the following issues: - CVE-2021-28701: Fixed race condition in XENMAPSPACEgranttable handling XSA-384 bsc1189632. - CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: Fixed IOMMU page mapping issues on x86 XSA-378bsc1189373. - CVE-2021-28697: Fixed grant table v2 status page...

Lodging Reservation Management System SQL注入漏洞

Lodging Reservation Management System is an open source accommodation reservation management system that is vulnerable to attackers using SQL injection to bypass authentication via username and password fields to grant any user access to privileges...

CVE-2021-41580

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants...

Debian DSA-4977-1 : xen - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4977 advisory. Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation, denial of service or information leaks. With the...

SUSE-SU-2021:3140-1 Security update for xen

This update for xen fixes the following issues: - CVE-2021-28701: Fixed race condition in XENMAPSPACEgranttable handling XSA-384 bsc1189632. - Upstream bug fixes bsc1027519...

keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity

A flaw was found in keycloak. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity...

keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity

A flaw was found in keycloak. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity...

keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity

A flaw was found in keycloak. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity...

keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity

A flaw was found in keycloak. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity...

Denial Of Service (DoS)

xen:edge is vulnerable to denial of service. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches back from v2 to v1. Freeing such pages requires that the hypervisor enforce that...

ALPINE-CVE-2021-28701

Another race in XENMAPSPACEgranttable handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches back from v2...

CVE-2021-28701

Another race in XENMAPSPACEgranttable handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches back from v2...

DEBIAN-CVE-2021-28701

Another race in XENMAPSPACEgranttable handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches back from v2...

CVE-2021-28701

Another race in XENMAPSPACEgranttable handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches back from v2...

UBUNTU-CVE-2021-28701

Another race in XENMAPSPACEgranttable handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches back from v2...

Another race in XENMAPSPACE_grant_table handling

ISSUE DESCRIPTION Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches back from v2 to v1. Freeing such pages...

Denial Of Service (DoS)

xen is vulnerable to denial of service. Long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to map grants offered by other domains. In the process of carrying out certain actions, Xen would itera...

openSUSE 15 Security Update : xen (openSUSE-SU-2021:1236-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1236-1 advisory. - Observable response discrepancy in some IntelR Processors may allow an authorized user to potentially enable information disclosure via...

SUSE-SU-2021:2957-1 Security update for xen

This update for xen fixes the following issues: - CVE-2021-3594: slirp: invalid pointer initialization may lead to information disclosure udpbsc1187378. - CVE-2021-3595: slirp: invalid pointer initialization may lead to information disclosure tftpbsc1187376. - CVE-2021-28698: long running loops i...

SUSE SLES12: xen / xen-doc-html / xen-libs / xen-libs-32bit / xen-tools / etc (SUSE-SU-2021:2957-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2957-1 advisory. - CVE-2021-3594: slirp: invalid pointer initialization may lead to information disclosure udpbsc1187378. - CVE-2021-3595: slirp:...