openSUSE Security Update : MozillaFirefox (openSUSE-2021-222)

This update for MozillaFirefox fixes the following issues : - Firefox Extended Support Release 78.7.0 ESR MFSA 2021-04, bsc1181414 - CVE-2021-23953: Fixed a Cross-origin information leakage via redirected PDF requests - CVE-2021-23954: Fixed a type confusion when using logical assignment operator...

pfSense < 2.4.4-p3 Multiple Vulnerabilities

According to its self-reported version number, the remote pfSense install is a version prior to 2.4.4-p3. It is, therefore, affected by multiple vulnerabilities, including the following: - In pfSense 2.4.41, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsiste...

CVE-2021-27142

An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions...

Hardcoded credentials

An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions...

CVE-2021-27142

The CVE-2021-27142 entry concerns FiberHome HG6245D devices (RP2613). The issue is that the web management interface runs over HTTPS but uses a hardcoded private key with permissions 0777, exposed in the device’s web stack. This configuration enables potential disclosure or misuse of the private ...

CVE-2021-27142

An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions...

Security Update for Microsoft ASP.NET Core (February 2021)

The Microsoft ASP.NET Core installation on the remote host is version 2.1.x prior to 2.1.25, 3.1.x prior to 3.1.126, or 5.x prior to 5.0.3. It is, therefore, affected by a denial of service vulnerability when creating HTTPS web requests during X509 certificate chain building. An unauthenticated,...

Security Update for .NET Core (February 2021) (macOS)

The Microsoft .NET Core runtime installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists in .NET Core when creating HTTPS web requests during X509 certificate chain building. An...

Security Update for .NET Core (February 2021)

The Microsoft .NET Core installation on the remote host is version 2.1.x prior to 2.1.25, 3.1.x prior to 3.1.126, or 5.x prior to 5.0.3. It is, therefore, affected by a denial of service vulnerability when creating HTTPS web requests during X509 certificate chain building. An unauthenticated,...

Security Update for .NET Core SDK (February 2021)

The Microsoft .NET Core SDK installation on the remote host is version 2.1.x prior to 2.1.521, 2.1.6xx prior to 2.1.813, 3.1.x prior to 3.1.112, 3.1.2xx prior to 3.1.406, or 5.x prior to 5.0.103. It is, therefore, affected by a denial of service vulnerability when creating HTTPS web requests duri...

PT-2021-2046 · Microsoft +3 · Net Core +4

Name of the Vulnerable Software and Affected Versions: .NET Core and Visual Studio affected versions not specified Description: The issue is related to insufficient input validation, which can be exploited by a remote attacker to cause a denial of service. This vulnerability exists when creating...

CVE-2021-26530

The mgtlsinit function in Cesanta Mongoose HTTPS server 7.0 compiled with OpenSSL support is vulnerable to remote OOB write attack via connection request after exhausting memory pool...

CVE-2021-26530

The mgtlsinit function in Cesanta Mongoose HTTPS server 7.0 compiled with OpenSSL support is vulnerable to remote OOB write attack via connection request after exhausting memory pool...

Design/Logic Flaw

The mgtlsinit function in Cesanta Mongoose HTTPS server 7.0 compiled with OpenSSL support is vulnerable to remote OOB write attack via connection request after exhausting memory pool...

Design/Logic Flaw

The mgtlsinit function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 compiled with mbedTLS support is vulnerable to remote OOB write attack via connection request after exhausting memory pool...

CVE-2021-26530

CVE-2021-26530 describes a vulnerability in Cesanta Mongoose HTTPS server 7.0 when compiled with OpenSSL. The vulnerable component is the mg_tls_init function, which allows a remote out-of-bounds write via a connection request after the memory pool is exhausted. The Connected documents confirm th...

CVE-2021-26530

The mgtlsinit function in Cesanta Mongoose HTTPS server 7.0 compiled with OpenSSL support is vulnerable to remote OOB write attack via connection request after exhausting memory pool...

CVE-2021-26529

The CVE-2021-26529 issue affects Cesanta Mongoose HTTPS server (versions 7.0 and 6.7–6.18 compiled with mbedTLS). The root cause is an out-of-bounds write in mg_tls_init triggered by a connection request after memory pool exhaustion, enabling a remote write condition. Documents indicate this is a...

MGASA-2021-0066 Updated thunderbird packages fix security vulnerabilities

Cross-origin information leakage via redirected PDF requests. CVE-2021-23953 Type confusion when using logical assignment operators in JavaScript switch statements. CVE-2021-23954 IMAP Response Injection when using STARTTLS. CVE-2020-15685 HTTPS pages could have been intercepted by a registered...

Updated thunderbird packages fix security vulnerabilities

Cross-origin information leakage via redirected PDF requests. CVE-2021-23953 Type confusion when using logical assignment operators in JavaScript switch statements. CVE-2021-23954 IMAP Response Injection when using STARTTLS. CVE-2020-15685 HTTPS pages could have been intercepted by a registered...