Cisco Issues Critical Security Patches to Fix Small Business VPN Router Bugs

Networking equipment major Cisco has rolled out patches to address critical vulnerabilities impacting its Small Business VPN routers that could be abused by a remote attacker to execute arbitrary code and even cause a denial-of-service DoS condition. The issues, tracked as CVE-2021-1609 CVSS scor...

HackerOne: Internal Gitlab Ticket Disclosure via External Slack Channels

@noneoftheabove was able to enumerate GitLab ticket titles and descriptions by posting links in a shared Slack channel. As part of HackerOne's investigation, it was determined that the misconfiguration could also be used to obtain the contents of exceptions from HackerOne's production environment...

[ASA-202107-65] jre-openjdk-headless: multiple issues

Arch Linux Security Advisory ASA-202107-65 ========================================== Severity: High Date : 2021-07-22 CVE-ID : CVE-2021-2341 CVE-2021-2369 CVE-2021-2388 Package : jre-openjdk-headless Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2188 Summary =====...

CVE-2021-2446

Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization component: Client. The supported version that is affected is 5.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Secure Global...

Ampache 4.4.2 Cross Site Scripting Vulnerability

Information -------------------- Advisory by Netsparker Name: Cross-site Scripting vulnerability in Ampache 4.4.2 Affected Software: Ampache Affected Versions: 4.4.2 Homepage: http://ampache.org/ Vulnerability: Cross-Site Scripting Severity: High Status: Fixed CVSS Score 3.0: 7.4 High Netsparker...

Ampache 4.4.2 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: Cross-site Scripting vulnerability in Ampache 4.4.2 Affected Software: Ampache Affected Versions: 4.4.2 Homepage: http://ampache.org/ Vulnerability: Cross-Site Scripting Severity: High Status: Fixed CVSS Score 3.0: 7.4 High Netsparker...

[ASA-202107-52] virtualbox: multiple issues

Arch Linux Security Advisory ASA-202107-52 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-2409 CVE-2021-2442 CVE-2021-2443 CVE-2021-2454 Package : virtualbox Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2187 Summary...

16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines

Researchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers also used by Samsung and Xerox, which impacts hundreds of millions of Windows machines. If exploited, cyberattackers could bypass security products; install programs; view, change, encry...

[ASA-202107-33] nodejs-lts-erbium: multiple issues

Arch Linux Security Advisory ASA-202107-33 ========================================== Severity: High Date : 2021-07-20 CVE-ID : CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 Package : nodejs-lts-erbium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2128 Summary =====...

[ASA-202107-24] ruby2.7: multiple issues

Arch Linux Security Advisory ASA-202107-24 ========================================== Severity: High Date : 2021-07-14 CVE-ID : CVE-2021-31810 CVE-2021-32066 Package : ruby2.7 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2139 Summary ======= The package ruby2.7...

Intel BSSA DFT Advisory - Lenovo Support US

No description provided...

Advisory ROSA-SA-2021-2001

Software: xdg-utils 1.1.0 OS: Cobalt 7.9 CVE-ID: CVE-2014-9622 CVE-Crit: HIGH CVE-DESC: Eval injection vulnerability in xdg-utils 1.1.0 RC1 in the absence of a supported desktop environment allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open. CVE-STATUS:...

Advisory ROSA-SA-2021-1996

Software: wget 1.14 OS: Cobalt 7.9 CVE-ID: CVE-2016-7098 CVE-Crit: HIGH CVE-DESC: The race condition in wget 1.17 and earlier, when used in recursive or mirror mode to download a single file, may allow remote servers to bypass perceived access list restrictions by leaving the HTTP connection open...

Advisory ROSA-SA-2021-1982

Software: system 219 OS: Cobalt 7.9 CVE-ID: CVE-2013-4392 CVE-Crit: HIGH CVE-DESC: systemd when updating file permissions allows local users to change SELinux permissions and security contexts for arbitrary files via a symbolic link attack on unspecified files. CVE-STATUS: default CVE-REV: defaul...

Advisory ROSA-SA-2021-1979

Software: subversion 1.7.14 OS: Cobalt 7.9 CVE-ID: CVE-2014-3504 CVE-Crit: HIGH CVE-DESC: The functions 1 serfsslcertissuer, 2 serfsslcertsubject, and 3 serfsslcertcertificate in Serf 0.2.0 - 1.3.x through 1.3.7 incorrectly handle the NUL byte in the domain name in the subject common name. CN in...

Advisory ROSA-SA-2021-1963

Software: rpm 4.11.3 OS: Cobalt 7.9 CVE-ID: CVE-2017-7501 CVE-Crit: HIGH CVE-DESC: It was discovered that rpm versions prior to 4.13.0.2 use temporary files with predictable names when installing RPM. An attacker with the ability to write to the directory where the files will be installed could...

Advisory ROSA-SA-2021-1956

Software: procps-ng 3.3.10 OS: Cobalt 7.9 CVE-ID: CVE-2018-1126. CVE-Crit: CRITICAL. CVE-DESC: procps-ng before version 3.3.15 is vulnerable due to incorrect integer size in proc / alloc. , Which leads to truncation / integer overflow problems. This flaw is related to CVE-2018-1124. CVE-STATUS:...

Advisory ROSA-SA-2021-1947

Software: pcre 8.32 OS: Cobalt 7.9 CVE-ID: CVE-2015-2327 CVE-Crit: MEDIUM CVE-DESC: PCRE before version 8.36 incorrectly handles the pattern / a \ 2 | a \ g / / and related patterns with certain internal recursive backlinks, allowing remote attackers to cause a denial of service segmentation erro...

Advisory ROSA-SA-2021-1932

Software: ntp 4.2.6p5 OS: Cobalt 7.9 CVE-ID: CVE-2015-5146 CVE-Crit: MEDIUM CVE-DESC: ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer trusted to perform remote configuration to cau...

Advisory ROSA-SA-2021-1897

Software: libtirpc 0.2.4 OS: Cobalt 7.9 CVE-ID: CVE-2018-14621 CVE-Crit: HIGH CVE-DESC: An infinite loop vulnerability was discovered in libtirpc before version 1.0.2-rc2. If a port uses polling rather than selection, exhaustion of file descriptors will cause the server to enter an infinite loop,...