4332 matches found
PT-2021-23926 · Google · Google Login
Name of the Vulnerable Software and Affected Versions: Redash versions 10.0 and prior Description: The implementation of Google Login in Redash incorrectly uses the state parameter to pass the next URL to redirect the user to after login, instead of using it for a Cross-Site Request Forgery CSRF...
Microsoft named a Leader in IDC MarketScape for Modern Endpoint Security for Enterprise and Small and Midsize Businesses
The security stakes have never been higher and, consequently, the protection of endpoints as a key component of any extended detection and response XDR strategy has never been more critical—for organizations of all sizes. Microsoft is thrilled to be recognized as a Leader in IDC’s MarketScape...
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function
...
DEBIAN-CVE-2021-42379
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nextinputfile function...
AZL-6346 CVE-2021-42379 affecting package busybox for versions less than 1.35.0-1
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nextinputfile function...
ALPINE-CVE-2021-42379
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nextinputfile function...
UBUNTU-CVE-2021-42379
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nextinputfile function...
AI-driven adaptive protection against human-operated ransomware
In human-operated ransomware attacks, threat actors use predictable methods to enter a device but eventually rely on hands-on-keyboard activities to move inside a network. To fortify our existing cloud-delivered automated protection against complex attacks like human-operated ransomware, we...
PT-2021-5546
Name of the Vulnerable Software and Affected Versions Busybox affected versions not specified Description A use-after-free issue in Busybox's awk applet can lead to denial of service and possibly code execution when processing a crafted awk pattern in the next input file function. This could allo...
Security Bulletin: Multiple vulnerabilites affect Engineering Lifecycle Management and IBM Engineering products.
Summary There are multiple vulnerabilities that are used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Engineering Lifecycle Management ELM, IBM Engineering Requirements Management DOORS Next DOORS Next, IBM Engineering Workflow Management EWM, IBM...
IBM Engineering Requirements Management DOORS Next 代码问题漏洞
IBM Engineering Requirements Management DOORS Next is a scalable solution from International Business Machines Corporation IBM. The solution helps you capture, track, analyze, and manage systems and advanced IT application development. IBM Engineering Requirements Management DOORS Next suffers fr...
next-iq.com Cross Site Scripting vulnerability OBB-2157367
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
PT-2021-27800
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 8 crash has been reported. The crash involves the get next owned entity and dwg write dxfb functions in the llvmfuzz.c file...
PT-2021-19690
Name of the Vulnerable Software and Affected Versions: gravity versions prior to 0.8.2 Description: An issue exists in the function list iterator next located in gravity core.c, allowing an attacker to cause Denial of Service due to a NULL pointer dereference. Recommendations: For versions prior ...
Ditch the Alert Cannon: Modernizing IDS is a Security Must-Do
After more than 20 years of underwhelming results, security leaders have accepted their intrusion detection system IDS programs as no more than a compliance checkoff. It’s no secret that IDS’s reliance on bi-modal signatures is brittle, easily evaded and often referred to as an “alert cannon.” Ti...
Security Bulletin: Security Vulnerabilities in IBM® Java SDK July 2021 CPU affect multiple IBM Continuous Engineering products based on IBM Jazz Technology
Summary There are multiple vulnerabilities in IBM® SDK Java Technology Edition from July 2021 CPU that are used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Engineering Lifecycle Management ELM, IBM Engineering Requirements Management DOORS Next DOORS...
PYSEC-2021-359
Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious...
CVE-2021-32805
Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious...
@0soft/use-nextjs-page-loader (>=0.0.23-alpha.5, <=0.0.25), @aaiello/rimble-ui (>=0.0.1, <=0.14.3) +480 more potentially affected by CVE-2021-39178 via next (>=10.0.0, <=11.1.0)
next NPM version =10.0.0, =0.0.23-alpha.5, =0.0.1, =0.1.0, =0.0.25, =0.0.1, =0.0.1, =0.0.13, =1.0.0, =2.0.0-bundle-perf-test.0, =0.0.2, =3.0.0-bundle-perf-test.0, =3.1.0-section-linker.0 and more Source cves: CVE-2021-39178 Source advisory: OSV:GHSA-9GR3-7897-PP7M...
GHSA-9GR3-7897-PP7M XSS in Image Optimization API for Next.js
Impact - Affected: All of the following must be true to be affected - Next.js between version 10.0.0 and 11.1.0 - The next.config.js file has images.domains array assigned - The image host assigned in images.domains allows user-provided SVG - Not affected: The next.config.js file has images.loade...