CVE-2021-32569

In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. This problem is completely resolved in new Ericsson library browsing tool ELEX used in systems like Ericsson Network Manager. NOTE: This vulnerability only...

CVE-2021-41331

Windows Media Audio Decoder Remote Code Execution Vulnerability...

br.com.guiabolso:hyperloop-transport (>=3.0.1 <=3.0.2), com.eoniantech:secrets-locker (>=1.0 <=1.2) +8 more potentially affected by CVE-2020-8897 via com.amazonaws:aws-encryption-sdk-java (>=0.0.1 <=1.9.0)

com.amazonaws:aws-encryption-sdk-java MAVEN version =0.0.1, =3.0.1, =1.0, =2.3.2, =0.3.0, =2.8.0, =2.11.1 - org.apache.ignite:ignite-aws-ext =1.0.0 - org.dreamhorizon:vertx-cron =1.0.0 - software.amazon.cloudformation:aws-cloudformation-rpdk-java-plugin =2.0.12 Source cves: CVE-2020-8897 Source...

Path traversal

A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries...

Side-channels Related to the x86 PREFETCH Instruction

Bulletin ID: AMD-SB-1017 Potential Impact: Leaked kernel address space information Severity: Medium Summary Researchers from Graz University of Technology with CISPA Helmholtz Center for Information Security have demonstrated timing and power-based side channel attacks leveraging the x86 PREFETCH...

Fedora: Security Advisory for dr_libs (FEDORA-2021-669df5ceb9)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated libcryptopp packages fix security vulnerability

The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's...

ai.hyacinth.framework:core-service-admin-server (>=0.5.2 <=0.5.21), ai.hyacinth.framework:core-service-gateway-server (>=0.5.2 <=0.5.21) +3919 more potentially affected by CVE-2021-28170 via org.glassfish:javax.el (>=3.0-b01 <=3.0.1-b12)

org.glassfish:javax.el MAVEN version =3.0-b01, =0.5.2, =0.5.2, =0.5.2, =0.18.5, =2.1.7.RELEASE, =6.1.0, =6.1.0, =6.1.0, =6.1.0, =1.0, =0.1-1, =0.1-16 and more Source cves: CVE-2021-28170 Source advisory: OSV:GHSA-V6W3-2PRQ-H95F...

ai.hyacinth.framework:core-service-admin-server (=0.5.24), ai.hyacinth.framework:core-service-gateway-server (=0.5.24) +7438 more potentially affected by CVE-2021-28170 via org.glassfish:jakarta.el (>=3.0.2 <=3.0.3)

org.glassfish:jakarta.el MAVEN version =3.0.2, =1.4.2, =1.6.6, =j8.2.3.0, =j8.2.3.0, =j8.2.3.0, =j8.2.2.0, =2.1.11-RC2, =2.3.1.RELEASE - at.rechnerherz:aoprofiling =1.0.0 - at.rechnerherz:aoprofiling-autoconfigure =1.0.0 - at.rechnerherz:aoprofiling-spring-boot-starter =1.0.0 and more Source cves...

com.github.ldeitos:extendedValidation-spring-boot-test-support (=2.0.0-Final), com.github.ldeitos:extendedValidation-test-support (>=0.9.3 <=2.0-RC2) +23 more potentially affected by CVE-2021-28170 via com.sun.el:el-ri (=1.0)

com.sun.el:el-ri MAVEN version =1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.sun.el:el-ri and may be impacted: - com.github.ldeitos:extendedValidation-spring-boot-test-support =2.0.0-Final - com.github.ldeitos:extendedValidation-test-support...

CVE-2021-34788

A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated, local attacker to perform a shared library hijacking attack on an affected device if the VPN Posture HostScan Module is installed on the AnyConnect...

Security Bulletin: IBM Security Guardium Insights is affected by an IBM SDK, Java Technology Edition Quarterly CPU - Jul 2020 - Includes Oracle Jul 2020 CPU vulnerability

Summary IBM Security Guardium Insights has addressed the following vulnerability Vulnerability Details CVEID: CVE-2020-14583 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause low confidentiality impact, low...

Missing zero address check for ecrecover will validate invalid signatures

Handle 0xRajeev Vulnerability details Impact Solidity’s ecrecover returns 0 if signature is invalid. The Sig.sol library does not perform zero address check on ecrecover’s return value and returns it as-is. The validOrderHash function in Swivel which uses Sig.recover compares its return value...

Webstor - A Script To Quickly Enumerate All Websites Across All Of Your Organization'S Networks, Store Their Responses, And Query For Known Web Technologies, Such As Those With Zero-Day Vulnerabilities

WebStor is a tool implemented in Python under the MIT license for quickly enumerating all websites across all of your organization's networks, storing their responses, and querying for known web technologies and versions, such as those with zero-day vulnerabilities. It is intended, in particular,...

[SECURITY] Fedora 35 Update: glibc-2.34-6.fc35

The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important se...

[SECURITY] Fedora 35 Update: openssl-1.1.1l-1.fc35

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols...

com.comcast.money:money-kafka_2.13 (>=0.9.1 <=0.15.1), com.consol.citrus:citrus-kafka (>=3.0.0-M2 <=3.0.0-M3) +57 more potentially affected by CVE-2021-38153 via org.apache.kafka:kafka_2.13 (>=2.4.0 <=2.6.2)

org.apache.kafka:kafka2.13 MAVEN version =2.4.0, =0.9.1, =3.0.0-M2, =1.7, =2.1.0, =3.5.1, =2.4.0, =2.5.1.2 - com.revivebird.finagle:finatra-kafka-streams-prerestore2.13 =25.11.0 and more Source cves: CVE-2021-38153 Source advisory: OSV:GHSA-3J6G-HXX5-3Q26...

JSPanda - Client-Side Prototype Pullution Vulnerability Scanner

JSpanda is client-side prototype pollution vulnerability scanner. It has two key features, scanning vulnerability the supplied URLs and analyzing the JavaScript libraries' source code. However, JSpanda cannot detect advanced prototype pollution vulnerabilities. How JSPanda works? Uses multiple...

Security Bulletin: Vulnerabilities in Java affect Power Hardware Management Console (CVE-2015-4843 CVE-2015-4868 CVE-2015-4806 CVE-2015-4872 CVE-2015-4911 CVE-2015-4893 CVE-2015-4842 CVE-2015-4803)

Summary Java is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-4843 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Libraries component has complete confidentiality impact, complete integrity...

Security Bulletin: Multiple Vulnerabilities in IBM Java SDK Affect Power Hardware Management Console (CVE-2014-6512, CVE-2014-3566, CVE-2014-6457, CVE-2014-6558)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 6 that is used by Power Hardware Management Console. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These were disclosed as part of the...