PT-2022-11323 · Unknown · Todo-Regex

Name of the Vulnerable Software and Affected Versions: todo-regex version 0.1.1 Description: A Regular Expression Denial of Service ReDOS issue was found in the software when it matches crafted invalid TODO statements. This occurs because the regular expression used can be exploited to cause a...

PT-2022-3000 · Adobe · Illustrator

Name of the Vulnerable Software and Affected Versions: Adobe Illustrator versions 26.0.2 and earlier and 25.4.5 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of...

GHSA-XQQW-CQJP-52XM Jenkins Log Parser Plugin vulnerable to Cross-site Scripting

Log Parser Plugin did not escape an error message shown when log parsing patterns are invalid. This resulted in a persisted cross-site scripting vulnerability exploitable by attackers able to control the log parsing rules configuration, typically users with Job/Configure permission. Jenkins appli...

CVE-2021-3155

snapd 2.54.2 and earlier created /snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1...

RM: calibre/buster-backports -- ROM; no security support; bpo10s of a newer version are impossible

Dear Backports admins, I am requesting the removal of calibre from buster-backports, because it has no security support and because newer versions of Calibre depend on a newer Qt version that cannot be backported. I delayed this request until Bullseye was released, so that users would have a...

PT-2021-19359 · Opentext · Opentext Brava! Desktop

Name of the Vulnerable Software and Affected Versions: OpenText Brava! Desktop version 16.6.3.84 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file...

PT-2021-11666 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Confluence Server versions prior to 7.4.8 Confluence Server versions 7.5.0 through 7.10.9 Description: The issue allows attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars...

MGASA-2021-0202 Updated nvidia390 packages fix security vulnerabilities

Updated nvidia390 packages fix security vulnerabilities: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko where improper access control may lead to denial of service, information disclosure, or data corruption CVE-2021-1076. It also fixes a bug where...

Updated nvidia390 packages fix security vulnerabilities

Updated nvidia390 packages fix security vulnerabilities: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko where improper access control may lead to denial of service, information disclosure, or data corruption CVE-2021-1076. It also fixes a bug where...

MGASA-2021-0203 Updated nvidia-current packages fix security vulnerabilities

Updated nvidia-current packages fix security vulnerabilities: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko where improper access control may lead to denial of service, information disclosure, or data corruption CVE-2021-1076. NVIDIA GPU Display...

Updated nvidia-current packages fix security vulnerabilities

Updated nvidia-current packages fix security vulnerabilities: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko where improper access control may lead to denial of service, information disclosure, or data corruption CVE-2021-1076. NVIDIA GPU Display...

Sql injection

eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sortby parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3. NOTE: this is different from CVE-2020-25034 and affects newer versions of the...

[SECURITY] Fedora 32 Update: python3.10-3.10.0~a6-1.fc32

Python 3.10 package for developers. This package exists to allow developers to test their code against a newer version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.10, update your Fedora to a newer version once Python 3.10 is stable...

project abandoned; migrate to the `aes-siv` crate

The Miscreant project has been abandoned and archived. The Rust implementation has been adapted into the new aes-siv crate which implements both the AES-CMAC-SIV and AES-PMAC-SIV constructions: Please migrate to the aes-siv crate. Alternatively see the aes-gcm-siv crate for a newer, faster...

PT-2020-4082 · Microsoft · Windows Language Pack Installer +1

Name of the Vulnerable Software and Affected Versions: Windows Language Pack Installer affected versions not specified Description: The issue is related to the improper handling of file operations by the Windows Language Pack Installer, allowing an attacker to run processes in an elevated context...

Multiple NETGEAR switching hubs vulnerable to cross-site request forgery

Overview GS716Tv2 and GS724Tv3 switching hubs provided by NETGEAR contain a cross-site request forgery vulnerability. Rei Yano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a user views a malicious page...

PT-2020-7817 · Alpine +5 · Python3

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The issue was investigated and found not to be a security issue. It was withdrawn by its CNA after further investigation. Recommendations: At the moment, there is no...

PT-2020-6834 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader and PDF Editor versions 11.2.1.53537 and earlier Description: The issue is related to an out-of-bounds read operation in memory, which can be exploited by opening a specially crafted malicious file or page, allowing a remote...

CVE-2019-18193

In Unisys Stealth core 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. Fixed included in 3.4.109, 4.0.027.13, 4.0.125 and 5.0.013.0...

PT-2019-16503 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 8.0.16 and prior Description: The issue allows a high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks can result in the unauthorized ability to cause a hang o...