CVE-2021-29951

The Mozilla Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating if an attacker spammed the 'Stop' command; but also...

Ubuntu Apport 后置链接漏洞

Canonical Ubuntu is a GNU/Linux operating system from the British company Canonical that focuses on desktop applications. A security vulnerability exists in Ubuntu Apport that stems from the incorrect handling of certain information gathering operations, which can be exploited by an attacker who...

CVE-2021-30465

The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container. The highest threat from this vulnerability is to data confidentiality and integrity ...

Security Bulletin: Multiple security vulnerabilities may affect IBM DB2 shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises

Summary IBM DB2 is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. Information about security vulnerabilities affecting DB2 has been published in multiple security bulletins as below. Vulnerability Details Refer to the security bulletins listed...

CVE-2021-24191

Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blo...

CVE-2021-24191

The CVE-2021-24191 entry concerns the WordPress WP Maintenance Mode & Site Under Construction plugin (versions before 1.8.2). A low-privilege user can abuse the AJAX action cp_plugins_do_button_job_later_callback to install any plugin (including a specific version) from the WordPress repository a...

WordPress plugin WP Maintenance Mode & Site Under Construction 安全漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . An authorization issue vulnerability exists in versions o...

WordPress plugin WP Maintenance Mode & Site Under Construction 安全漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . WP Maintenance Mode & Site Under Construction An...

Unauthorized Access Vulnerability in the Operations and Maintenance Audit System of Xinhua San Technologies Co.

Xinhua San Technology Co., Ltd. is committed to becoming the most reliable partner for customers' business innovation and digital transformation. The main products are routers, big data, switches, IoT, cloud computing, servers and so on. An unauthorized access vulnerability exists in the Operatio...

Update of bind-sdb, bind-libs, bind-devel, bind, bind-utils, bind-chroot

...

Security fix for the ALT Linux 10 package firefox-esr version 78.10.1-alt1

May 5, 2021 Andrey Cherepanov 78.10.1-alt1 - New version 78.10.1. - Security fixes: + CVE-2021-29951 Mozilla Maintenance Service could have been started or stopped by domain users...

Security Vulnerabilities fixed in Thunderbird 78.10.1 — Mozilla

The Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating if an attacker spammed the 'Stop' command; but also exposed atta...

Security Vulnerabilities fixed in Firefox ESR 78.10.1 — Mozilla

The Mozilla Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating if an attacker spammed the 'Stop' command; but also...

Mozilla Firefox ESR < 78.10.1

"The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 78.10.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-18 advisory. - The Mozilla Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grant...

Mozilla Firefox ESR < 78.10.1

"The version of Firefox ESR installed on the remote Windows host is prior to 78.10.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-18 advisory. - The Mozilla Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal...

Mozilla Thunderbird 权限许可和访问控制问题漏洞

Mozilla Thunderbird is an open source email client. Mozilla Thunderbird is vulnerable to permission permission and access control issues, which stem from the way Mozilla maintenance services are installed on the Windows operating system. No detailed vulnerability details are currently available...

Mozilla Thunderbird < 78.10.1

"The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 78.10.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-19 advisory. - The Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal...

WordPress CMP – Coming Soon & Maintenance plugin <= 4.0.9 - Authenticated Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Ngo Van Thien Sun Cyber Security Research Team Patchstack Red Team member in WordPress CMP – Coming Soon & Maintenance plugin versions = 4.0.9. Solution Update the WordPress CMP – Coming Soon & Maintenance plugin to the latest available versio...

Security Bulletin: z/TPF is affected by an OpenSSL vulnerability

Summary The z/TPF version of OpenSSL was updated to address the vulnerability described by CVE-2021-3449. Vulnerability Details CVEID: CVE-2021-3449 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signaturealgorithms processing. By sending a...

ALPINE-CVE-2021-25215

In BIND 9.0.0 - 9.11.29, 9.12.0 - 9.16.13, and versions BIND 9.9.3-S1 - 9.11.29-S1 and 9.16.8-S1 - 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 - 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record...