GHSA-7WJX-3G7J-8584 Possible DoS Vulnerability in Action Controller Token Authentication

There is a possible DoS vulnerability in the Token Authentication logic in Action Controller. Versions Affected: = 4.0.0 Not affected: 4.0.0 Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 Impact ------ Impacted code uses authenticateorrequestwithhttptoken or authenticatewithhttptoken for reques...

admin-tool-button (>=1.0.1a0 <=1.0.5a0), apis-ampel (=0.1.0) +44 more potentially affected by CVE-2021-31542 via django (>=3.2.0 <=3.2.0rc1)

django PYPI version =3.2.0, =1.0.1a0, =0.2.0, =0.14.0, =0.13.0, =0.8.0, =0.9.16 and more Source cves: CVE-2021-31542 Source advisory: OSV:PYSEC-2021-7...

Possible DoS Vulnerability in Action Controller Token Authentication

There is a possible DoS vulnerability in the Token Authentication logic in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2021-22904. Versions Affected: = 4.0.0 Not affected: 4.0.0 Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 Impact ------ Impacted code uses...

@ajesus37/node-portcheck (=1.0.0), @hzabala/tplinkcloud-api-client (=1.0.0) +60 more potentially affected by CVE-2021-27191 via get-ip-range (=2.1.1)

get-ip-range NPM version =2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on get-ip-range and may be impacted: - @ajesus37/node-portcheck =1.0.0 - @hzabala/tplinkcloud-api-client =1.0.0 - @julusian/tp-link-tapo-connect =2.1.0-0 -...

Gigaset Android Update Server Hacked to Install Malware on Users' Devices

Gigaset has revealed a malware infection discovered in its Android devices was the result of a compromise of a server belonging to an external update service provider. Impacting older smartphone models — GS100, GS160, GS170, GS180, GS270 plus, and GS370 plus series — the malware took the form of...

angleview (=0.0.0.dev1), bacant (=3.4.0) +61 more potentially affected by CVE-2020-28463 via reportlab (>=3.1.44 <=3.5.53)

reportlab PYPI version =3.1.44, =0.0.1.dev1, =1.1.1, =1.0.0, =2.0.1.16012810, =2.0.1.16012810, =2.0.1.16012810, =0.7.0, =0.1.0, =0.0.2, =1.1.0, =1.3.0 - invenio-testing =0.1.1 and more Source cves: CVE-2020-28463 Source advisory: OSV:GHSA-MPVW-25MG-59VX...

CVE-2021-20280

Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...

angleview (=0.0.0.dev1), bacant (=3.4.0) +61 more potentially affected by CVE-2020-28463 via reportlab (>=3.1.44 <=3.5.53)

reportlab PYPI version =3.1.44, =0.0.1.dev1, =1.1.1, =1.0.0, =2.0.1.16012810, =2.0.1.16012810, =2.0.1.16012810, =0.7.0, =0.1.0, =0.0.2, =1.1.0, =1.3.0 - invenio-testing =0.1.1 and more Source cves: CVE-2020-28463 Source advisory: OSV:PYSEC-2021-146...

activedirectoryenum (>=0.4.7 <=0.5.0), airflow-run (=0.4.9) +215 more potentially affected by CVE-2020-36242 via cryptography (>=3.1.0 <=3.3.1)

cryptography PYPI version =3.1.0, =0.4.7, =0.117.0b0, =0.8.0, =2.0.1, =8.0.1, =0.0.3, =0.9.1, =0.11.0 - azureml-accel-models =1.23.0 - azureml-cli-common =1.23.0 - azureml-contrib-fairness =1.23.0 - azureml-contrib-functions =1.23.0 - azureml-contrib-gbdt =1.23.0 - azureml-contrib-interpret =1.23...

Moodle Resource Management Error Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A resource management error vulnerability exists in Moodle versions prior to 3.10.1, 3.9.4, 3.8.7 and 3.5.16, where messaging does not...

@csnext/cs-timeline (>=0.0.101-beta.22 <=0.0.132-beta.446), @net7/components (>=3.0.2-rc.2 <=4.3.2) +4 more potentially affected by CVE-2020-28487 via vis-timeline (>=7.1.3 <=7.4.2)

vis-timeline NPM version =7.1.3, =0.0.101-beta.22, =3.0.2-rc.2, =2.0.0, =1.3.0, =3.1.1-build1667201258, =3.1.2-build1667201375 Source cves: CVE-2020-28487 Source advisory: SNYK:JS-VISTIMELINE-1063500...

Security Bulletin: Rational Synergy vulnerability (CVE-2014-4263, CVE-2014-3068,CVE-2014-3566,CVE-2014-6457)

Summary A possible security vulnerability has been reported in the JSSE component of IBM Java shipped with Rational Synergy. Vulnerability Details CVE-ID: CVE-2014-4263 Description: An unspecified vulnerability related to the Security component has partial confidentiality impact, partial integrit...

SolarWinds Issues Second Hotfix for Orion Platform Supply Chain Attack

Network monitoring services provider SolarWinds officially released a second hotfix to address a critical vulnerability in its Orion platform that was exploited to insert malware and breach public and private entities in a wide-ranging espionage campaign. In a new update posted to its advisory...

VMSA-2020-0029:VMware ESXi, Workstation, Fusion and Cloud Foundation updates address a denial of service vulnerability

Advisory ID: VMSA-2020-0029.1 CVSSv3 Range: 3.3 Issue Date:2020-12-17 Updated On: 2021-02-09 CVEs: CVE-2020-3999 Synopsis: VMware ESXi, Workstation, Fusion and Cloud Foundation updates address a denial of service vulnerability CVE-2020-3999 RSS Feed Download PDF Download Text File Share this page...

accuinsight (>=1.0.47 <=1.0.61), alphad3m (>=0.10.0 <=0.10.0.dev1) +86 more potentially affected by CVE-2020-26266 via tensorflow (>=2.2.0 <=2.2.1)

tensorflow PYPI version =2.2.0, =1.0.47, =0.10.0, =0.5.0, =0.2.0, =0.0.6, =1.2.0, =1.0.0, =0.0.15, =0.0.16 and more Source cves: CVE-2020-26266 Source advisory: OSV:GHSA-QHXX-J73R-QPM2...

Critical VMware Zero-Day Bug Allows Command Injection; Patch Pending

The U.S. Cybersecurity and Infrastructure Security Agency is warning of a zero-day bug affecting six VMware products including its Workspace One, Identity Manager and vRealize Suite Lifecycle Manager. The critical unpatched bug is a command injection vulnerability. In a separate VMware advisory,...

KLA12101 Use after free vulnerability in VMware Workstation and Player

A use after free vulnerability was found in VMware Workstation and Player. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories VMSA-2020-0026 Related products VMware-Workstation VMware-Player CVE list CVE-2020-4004 critical Solution Update to the latest...

accel-mma84 (>=0.2.0 <=0.2.0-beta.3), bus (>=0.2.0 <=2.2.3) +14 more potentially affected by CVE-2020-36219 via atomic-option (=0.1.2)

atomic-option CARGO version =0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on atomic-option and may be impacted: - accel-mma84 =0.2.0, =0.2.0, =0.0.1, =0.7.0, =0.2.5, =1.0.0, =0.3.0, =0.1.0, =0.3.0 and more Source cves: CVE-2020-36219 Source...

@intesso/scratch-paint (=0.2.0), @wdr-data/scratch-render (=0.1.0-prerelease.20180918201144-fixed-1) +13 more potentially affected by CVE-2020-7750 via scratch-svg-renderer (>=0.1.0-prerelease.20180524210316 <=0.2.0-prerelease.20201016121710)

scratch-svg-renderer NPM version =0.1.0-prerelease.20180524210316, =0.0.1, =0.1.0-prerelease.2019-05-26T04-34Z, =0.2.0-prerelease.20181120191526, =0.1.0-prerelease.20210117145449, =0.1.0-prerelease.20200903194013, =0.2.0, =0.1.0-prerelease.20180531210700, =0.1.0, =0.1.0-prerelease.20201214071805,...

02strich-markdown (>=1.0.0 <=1.0.2), 10secondsofcode-custom (=1.0.0) +11494 more potentially affected by CVE-2020-7753 via trim (=0.0.1)

trim NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on trim and may be impacted: - 02strich-markdown =1.0.0, =1.0.0, =0.0.2, =0.0.1, =4.11.0, =0.1.0, =0.0.2, =0.2.0, =1.0.16, =1.2.0, =1.2.2 and more Source cves: CVE-2020-7753 Source...