Design/Logic Flaw

Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction wi...

CVE-2021-31876

CVE-2021-31876 affects Bitcoin Core versions 0.12.0–0.21.1. The issue stems from not properly enforcing the replacement policy in BIP125, where an unconfirmed child with nSequence = 0xff_ff_ff_ff can be treated as replaceable, but the mempool rejects the replacement due to an inadequate PreChecks...

CVE-2021-31876

Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction wi...

CVE-2021-31876

Removed by vendor...

ansible: multiple modules expose secured values

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the nolog feature. An...

CVE-2021-0224

A vulnerability in the handling of internal resources necessary to bring up a large number of Layer 2 broadband remote access subscriber BRAS nodes in Juniper Networks Junos OS can cause the Access Node Control Protocol daemon ANCPD to crash and restart, leading to a Denial of Service DoS...

CVE-2021-0224 Junos OS: ANCPD core when hitting maximum-discovery-table-entries limit

A vulnerability in the handling of internal resources necessary to bring up a large number of Layer 2 broadband remote access subscriber BRAS nodes in Juniper Networks Junos OS can cause the Access Node Control Protocol daemon ANCPD to crash and restart, leading to a Denial of Service DoS...

Design/Logic Flaw

Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags...

CVE-2021-22540 XSS in Dart SDK

Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags...

Denial Of Service (DoS)

matrix-synapse is vulnerable to denial of service. The vulnerability exists due to missing input validation of some parameters on the endpoints used to confirm third-party identifiers...

Information Disclosure

ansible is vulnerable to information disclosure. Several modules within ansible log credentials such as secret and encryption keys in plain-text on managed nodes and can be accessed from log files...

Wallarm API Discovery: Discover API endpoints automatically and secure them

What do you know about your APIs? Why are the vulnerable v2 and v3 still exposed if they are deprecated for almost a year? What else is exposed and you don’t even know? Are Swagger specs up to date? Teaser: Surely not. A lot of questions, right? Meet Wallarm’s latest feature for API Discovery and...

Watch Out! Mission Critical SAP Applications Are Under Active Attack

Cyber attackers are actively setting their sights on unsecured SAP applications in an attempt to steal information and sabotage critical processes, according to new research. "Observed exploitation could lead in many cases to full control of the unsecured SAP application, bypassing common securit...

CVE-2021-3447

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the nolog feature. An...

UBUNTU-CVE-2021-3447

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the nolog feature. An...

CVE-2021-3447

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the nolog feature. An...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2021-21334)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability found in containerd that could allow containers using the same image to share environment variables CVE-2021-21334. Vulnerability Details CVEID: CVE-2021-21334 In containerd an industry-standard container runtime before...

Default credentials

A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS I...

CVE-2019-10200

CVE-2019-10200 affects OpenShift Container Platform 4. By default, users who can create pods may schedule workloads on master nodes. If such pods use hostNetwork on a master node, they can retrieve credentials for the master AWS IAM role, potentially granting management access to AWS resources an...

Design/Logic Flaw

A flaw was found in the OpenShift Installer before version v0.9.0-master.0.20210125200451-95101da940b0. During installation of OpenShift Container Platform 4 clusters, bootstrap nodes are provisioned with anonymous authentication enabled on kubelet port 10250. A remote attacker able to reach this...