CVE-2021-24298

CVE-2021-24298 affects WordPress Simple Giveaways plugin versions before 2.36.2. The vulnerability is a reflected XSS in the Giveaway pages caused by unsanitized, unvalidated, and unescaped method and share GET parameters that are echoed back in the page output. Exploitation would allow an attack...

Plone cross-site scripting vulnerability (CNVD-2021-37275)

Plone is the industry's leading open source CMS system for content management, document management and knowledge management. A cross-site scripting vulnerability exists in Plone 5.2.4 and earlier versions. The vulnerability can be exploited to conduct cross-site scripting attacks via the inlinedi...

GHSA-6G88-99WJ-8MGG Command injection in Apache Flink

A vulnerability in Apache Flink where, when running a process with an enabled JMXReporter, with a port configured via metrics.reporter.reportername.port, an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind th...

GHSA-4G52-PQCJ-PHVH BLS Signature "Malleability"

Impact 1. BLS signature validation in lotus uses blst library method VerifyCompressed. This method accepts signatures in 2 forms - "serialized", and "compressed", meaning that BLS signatures can be provided as either of 2 unique byte arrays. 2. Lotus block validation functions perform a uniquenes...

SUSE-SU-2021:1650-1 Security update for rubygem-actionpack-4_2

This update for rubygem-actionpack-42 fixes the following issues: - CVE-2021-22885: Fixed possible information disclosure / unintended method execution in Action Pack bsc1185715...

Huawei EulerOS: Security Advisory for PyYAML (EulerOS-SA-2021-1912)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

python-urllib3: CRLF injection via HTTP request method

A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation of the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrit...

libX11: Heap overflow in the X input method client

A flaw was found in libX11. An integer overflow leading to a heap-buffer overflow occurs when setuid programs call XIM client functions while running with elevated privileges. The highest threat from this vulnerability are to data confidentiality and integrity as well as system vulnerability...

python: CRLF injection via HTTP request method in httplib/http.client

A flaw was found in Python. The built-in modules httplib and http.client included in Python 2 and Python 3, respectively do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat fr...

python38:3.8 security update

An update is available for python-psycopg2, python-PyMySQL, python-lxml, python3x-six, python-urllib3, PyYAML, python-jinja2, python-requests, modwsgi, python38, python-asn1crypto, python3x-pip, python-chardet, python-markupsafe, Cython, python-psutil, python-ply, babel, python-wheel,...

IBM Cloud Pak for Security Information Disclosure Vulnerability (CNVD-2021-36325)

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. An information disclosure vulnerability exists in IBM Cloud Pak for Security...

GNU LibreDWG Heap Buffer Overflow Vulnerability (CNVD-2021-36634)

LibreDWG is a free C library for reading and writing DWG files. A heap buffer overflow vulnerability exists in GNU LibreDWG version 0.10.2641. An attacker can exploit this vulnerability via htmlescape ... /... /programs/escape.c:48 to exploit the vulnerability and cause a heap buffer overflow...

Cross-site scripting in jspdf

Affected versions of this package are vulnerable to Cross-site Scripting XSS. It's possible to inject JavaScript code via the html method...

GHSA-VH59-V9R5-4MH4 Cross-site scripting in jspdf

Affected versions of this package are vulnerable to Cross-site Scripting XSS. It's possible to inject JavaScript code via the html method...

Weak password vulnerability in FC-Series (CNVD-2021-37545)

FLIR Systems, Inc. specializes in the design, development, production, marketing and promotion of specialized technologies for enhanced situational awareness. Through thermal imaging, visible light imaging, video analytics, measurement and diagnostics, and advanced threat detection systems, we...

Ubuntu 20.04 LTS : PyYAML vulnerability (USN-4940-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4940-1 advisory. It was discovered that PyYAML incorrectly handled untrusted YAML files with the FullLoader loader. A remote attacker could possibly use this issue to execute...

Debian DLA-2655-1 : rails security update

CVE-2021-22885 There is a possible information disclosure/unintended method execution vulnerability in Action Pack when using the redirectto or polymorphicurl helper with untrusted user input. CVE-2021-22904 There is a possible DoS vulnerability in the Token Authentication logic in Action...

Debian: Security Advisory (DLA-2655-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2655-1] rails security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2655-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta May 12, 2021 https://wiki.debian.org/LTS - -----------------------------------------------------------------------...

Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code

Impact This vulnerability impacts generated code. If this code was generated as a one-off occasion, not as a part of an automated CI/CD process, this code will remain vulnerable until fixed manually! On Unix-Like systems, the system temporary directory is shared between all local users. When...