MGASA-2021-0237 Updated squid packages fix security vulnerabilities

Updated squid packages fix security vulnerabilities: Due to improper input validation Squid is vulnerable to an HTTP Request Smuggling attack. This problem allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by Squid security controls CVE-2020-25097...

CVE-2021-20699

Sharp NEC Displays UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior to it, UN552A R1.300 and prior to it, UN552S R1.300 and prior to it, UN552VS R1.300 and prior to it, UN552 R1.300 and prior to it, UN552V R1.300 and prior to i...

CVE-2021-20698

Sharp NEC Displays UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior to it, UN552A R1.300 and prior to it, UN552S R1.300 and prior to it, UN552VS R1.300 and prior to it, UN552 R1.300 and prior to it, UN552V R1.300 and prior to i...

Buffer overflow

Sharp NEC Displays UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior to it, UN552A R1.300 and prior to it, UN552S R1.300 and prior to it, UN552VS R1.300 and prior to it, UN552 R1.300 and prior to it, UN552V R1.300 and prior to i...

CVE-2021-20699

Sharp NEC Displays UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior to it, UN552A R1.300 and prior to it, UN552S R1.300 and prior to it, UN552VS R1.300 and prior to it, UN552 R1.300 and prior to it, UN552V R1.300 and prior to i...

CVE-2021-20699

CVE-2021-20699 affects Sharp NEC Displays (multiple models) where firmware versions up to R1.300/R2.000/R3.201 and earlier are vulnerable to a buffer overflow by sending long HTTP parameters containing specific characters, enabling remote code execution. Affected products include UN462A/UN462VA/U...

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request then data can be provided which will trigger a second unexpected and user-defined HTTP request to made to the same server.

...

SuiteCRM Log File Remote Code Execution Exploit

This Metasploit module exploits an input validation error on the log file extension parameter. It does not properly validate upper/lower case characters. Once this occurs, the application log file will be treated as a php file. The log file can then be populated with php code by changing the...

EulerOS Virtualization 2.9.0 : curl (EulerOS-SA-2021-1969)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad...

Moderate: Red Hat Security Advisory: rh-ruby27-ruby security, bug fix, and enhancement update

An update for rh-ruby27-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...

SUSE SLES12 Security Update : squid (SUSE-SU-2021:1838-1)

This update for squid fixes the following issues : update to 4.15 : CVE-2021-28652: Broken cache manager URL parsing bsc1185918 CVE-2021-28651: Memory leak in RFC 2169 response parsing bsc1185921 CVE-2021-28662: Limit HeaderLookupTablet::lookup to BadHdr and specific IDs bsc1185919 CVE-2021-31806...

SUSE-SU-2021:1838-1 Security update for squid

This update for squid fixes the following issues: - update to 4.15: - CVE-2021-28652: Broken cache manager URL parsing bsc1185918 - CVE-2021-28651: Memory leak in RFC 2169 response parsing bsc1185921 - CVE-2021-28662: Limit HeaderLookupTablet::lookup to BadHdr and specific IDs bsc1185919 -...

Design/Logic Flaw

IBM Security Verify Access 20.07 could allow a remote attacker to send a specially crafted HTTP GET request that could cause the application to crash...

CVE-2019-14839

A flaw was found in Business Central. When logging into the Business-central console, the HTTP request discloses sensitive information such as the username and password. This issue occurs when intercepted with tools like Burp Suite, etc...

CVE-2021-32637

Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngxhttpauthrequestmodule with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect...

CVE-2021-32637

Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngxhttpauthrequestmodule with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect...

Authentication flaw

Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngxhttpauthrequestmodule with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect...

Basecamp: HTTP Request Smuggling via HTTP/2

HTTP Request Smuggling via HTTP/2...

SonicWall NSM On-Prem OS Command Injection Vulnerability

SonicWall NSM On-Prem is an application from Sonicwall USA, Inc. It provides unlimited scalability to support thousands of SonicWall security appliances under its management. SonicWall NSM On-Prem suffers from an operating system command injection vulnerability that can be exploited by an attacke...