GNU LibreDWG Heap Buffer Overflow Vulnerability (CNVD-2021-36634)

LibreDWG is a free C library for reading and writing DWG files. A heap buffer overflow vulnerability exists in GNU LibreDWG version 0.10.2641. An attacker can exploit this vulnerability via htmlescape ... /... /programs/escape.c:48 to exploit the vulnerability and cause a heap buffer overflow...

IBM Cloud Pak for Security Information Disclosure Vulnerability (CNVD-2021-36325)

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. An information disclosure vulnerability exists in IBM Cloud Pak for Security...

Cross-site scripting in jspdf

Affected versions of this package are vulnerable to Cross-site Scripting XSS. It's possible to inject JavaScript code via the html method...

GHSA-VH59-V9R5-4MH4 Cross-site scripting in jspdf

Affected versions of this package are vulnerable to Cross-site Scripting XSS. It's possible to inject JavaScript code via the html method...

Weak password vulnerability in FC-Series (CNVD-2021-37545)

FLIR Systems, Inc. specializes in the design, development, production, marketing and promotion of specialized technologies for enhanced situational awareness. Through thermal imaging, visible light imaging, video analytics, measurement and diagnostics, and advanced threat detection systems, we...

Debian: Security Advisory (DLA-2655-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2655-1 : rails security update

CVE-2021-22885 There is a possible information disclosure/unintended method execution vulnerability in Action Pack when using the redirectto or polymorphicurl helper with untrusted user input. CVE-2021-22904 There is a possible DoS vulnerability in the Token Authentication logic in Action...

Ubuntu 20.04 LTS : PyYAML vulnerability (USN-4940-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4940-1 advisory. It was discovered that PyYAML incorrectly handled untrusted YAML files with the FullLoader loader. A remote attacker could possibly use this issue to execute...

[SECURITY] [DLA 2655-1] rails security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2655-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta May 12, 2021 https://wiki.debian.org/LTS - -----------------------------------------------------------------------...

GHSA-CQXR-XF2W-943W Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code

Impact This vulnerability impacts generated code. If this code was generated as a one-off occasion, not as a part of an automated CI/CD process, this code will remain vulnerable until fixed manually! On Unix-Like systems, the system temporary directory is shared between all local users. When...

Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code

Impact This vulnerability impacts generated code. If this code was generated as a one-off occasion, not as a part of an automated CI/CD process, this code will remain vulnerable until fixed manually! On Unix-Like systems, the system temporary directory is shared between all local users. When...

Security update for syncthing (moderate)

openSUSE Security Update: Security update for syncthing Announcement ID: openSUSE-SU-2021:0713-1 Rating: moderate References: 1184428 Cross-References: CVE-2021-21404 CVSS scores: CVE-2021-21404 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP...

FreeBSD : Rails -- multiple vulnerabilities (f7a00ad7-ae75-11eb-8113-08002728f74c)

Ruby on Rails blog : Rails versions 6.1.3.2, 6.0.3.7, and 5.2.6 have been released! These releases contain important security fixes. Here is a list of the issues fixed : CVE-2021-22885: Possible Information Disclosure / Unintended Method Execution in Action Pack CVE-2021-22902: Possible Denial of...

OS Command Injection in falconchristmas/fpp

✍️ Description FPP - Falcon Player is vulnerable to OS Command injection attacks on ping.php because it doesnt sanitize user supplied parameters as shown below. : Vulnerable variable: count Method: GET The $count variable is constructed using the user supplied data, and then is used in a system...

Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype...

GHSA-24WW-MC5X-XC43 Man-in-the-middle attack in Apache Cassandra

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and...

CVE-2021-3502

A flaw was found in avahi 0.8-5. A reachable assertion is present in avahishostnameresolverstart function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this...

Information Disclosure

actionpack is vulnerable to information disclosure. When using redirectto or polymorphicurl with untrusted user input, there is possible unintended unintended method execution vulnerability that can lead to information disclosure...

Unspecified Vulnerability in Mozilla Rust (CNVD-2021-33046)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in the standard library in Rust prior to version 1.29.0, which stems from weak synchronization in the Arc::get mut method. This synchronization issue could lead to memory safety...

Action Pack contains Information Disclosure / Unintended Method Execution vulnerability

Impact ------ There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the redirectto or polymorphicurl helper with untrusted user input. Vulnerable code will look like this. redirecttoparams:someparam All users running an affected release...