PT-2021-30304

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.76 Description The issue is related to a mismatch between reconstructed freelist depth and cnt in the slub component of the Linux Kernel. The actual impact and attack plausibility have not yet been proven...

PT-2021-30264

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.214 Description The issue is related to a mismatch between reconstructed freelist depth and cnt in the slub component of the Linux Kernel. The actual impact and attack plausibility have not yet been proven...

PT-2021-30281

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.156 Description The issue is related to a mismatch between reconstructed freelist depth and cnt in the slub component of the Linux Kernel. The actual impact and attack plausibility have not yet been proven...

PT-2021-26344

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.14.15 Description: The issue is related to a mismatch between reconstructed freelist depth and cnt in the slub allocator. The actual impact and attack plausibility have not yet been proven. Recommendations: F...

PT-2021-26269

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.214 Description: A potential security issue exists due to a mismatch between reconstructed freelist depth and count. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

PT-2021-26286

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.156 Description: The issue is related to a mismatch between reconstructed freelist depth and cnt in the slub allocator. The actual impact and attack plausibility have not yet been proven. Recommendations: F...

CVE-2021-36357

An issue was discovered in OpenPOWER 2.6 firmware. unpacktimestamp calls le32tocpu for endian conversion of a uint16t "year" value, resulting in a type mismatch that can truncate a higher integer value to a smaller one, and bypass a timestamp check. The fix is to use the right endian conversion...

CVE-2021-36357: Incorrect Conversion between Numeric Types

An issue was discovered in OpenPOWER 2.6 firmware. unpacktimestamp calls le32tocpu for endian conversion of a uint16t "year" value, resulting in a type mismatch that can truncate a higher integer value to a smaller one, and bypass a timestamp check. The fix is to use the right endian conversion...

PT-2021-21249

Name of the Vulnerable Software and Affected Versions OpenPOWER version 2.6 Description An issue was discovered in the OpenPOWER firmware. The unpack timestamp function calls le32 to cpu for endian conversion of a uint16 t "year" value, resulting in a type mismatch that can truncate a higher...

CVE-2021-0685

In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

多款Qualcomm产品访问控制错误漏洞

Qualcomm MDM9206 and others are products of Qualcomm Incorporated Qualcomm.MDM9206 is a central processing unit CPU product.MDM9607 is a central processing unit CPU product.MDM9640 is a central processing unit CPU product. The Access Control Error vulnerability exists in multiple Qualcomm product...

Oracle Linux 8 : curl (ELSA-2021-3582)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3582 advisory. - fix bad connection reuse due to flawed path name checks CVE-2021-22924 Tenable has extracted the preceding description block directly from the Oracle...

curl: Content not matching hash in Metalink is not being discarded

A flaw was found in curl in the way curl handles a file hash mismatch after downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to trick users into downloading malicious content. The highest threat from this vulnerability is to integrity...

Acronis: Domain does not Match SSL Certificate

Summary While examining the subdomains for acronis.com, I noticed that https://pa.acronis.com is not currently protected by your SSL certificate. Steps To Reproduce Open firefox and copy/paste the following into the search bar: https://pa.acronis.com After you hit enter you will be transferred to...

CVE-2021-22148

Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator. This could lead to a less privileged user gaining access to unauthorized engines...

CVE-2021-33695: Improper Validation of Certificate with Host Mismatch

Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate...

PT-2021-6973 · Microsoft · Office

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Description: The issue is related to a component of Microsoft Office Graphics, where an incompatibility in resource access types can be exploited. This can allow an attacker to execute arbitrar...

PT-2021-6858

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.4.6 and below Description The issue is related to an improper validation of certificate with host mismatch, which may allow the connection to a malicious LDAP server via options in the GUI. This could lead to the disclosure ...

CVE-2021-1919

Integer underflow can occur when the RTCP length is lesser than than the actual blocks present in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables...

CVE-2021-31786

The Bluetooth Classic Audio implementation on Actions ATS2815 and ATS2819 devices does not properly handle a connection attempt from a host with the same BDAddress as the current connected BT host, allowing attackers to trigger a disconnection and deadlock of the device by connecting with a forge...