CVE-2021-2018

CVE-2021-2018 affects Oracle Database Server’s Advanced Networking Option. Affected: Oracle Database Server 18c and 19c. Root cause per documented material: vulnerability in the Advanced Networking Option component; attacker can exploit via Oracle Net with network access, requiring no authenticat...

Oracle Database Server Authorization Issues Vulnerability

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing and other functions. A security vulnerability exists in the Advanced Networking Option component of Oracle...

EulerOS 2.0 SP3 : ImageMagick (EulerOS-SA-2021-1074)

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image...

Oracle Database Server 授权问题漏洞

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing and other functions. A security vulnerability exists in the Advanced Networking Option component of Oracle...

CVE-2020-26298

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml opti...

CVE-2020-17509

ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected...

Default configuration

An issue was discovered in Veritas Desktop and Laptop Option DLO before 9.4. On start-up, it loads the OpenSSL library from /ReleaseX64/ssl. This library attempts to load the /ReleaseX64/ssl/openssl.cnf configuration file, which does not exist. By default, on Windows systems, users can create...

CVE-2020-36165

An issue was discovered in Veritas Desktop and Laptop Option DLO before 9.4. On start-up, it loads the OpenSSL library from /ReleaseX64/ssl. This library attempts to load the /ReleaseX64/ssl/openssl.cnf configuration file, which does not exist. By default, on Windows systems, users can create...

CVE-2020-36165

CVE-2020-36165 affects Veritas Desktop and Laptop Option (DLO) before 9.4. At startup, DLO loads the OpenSSL library from /ReleaseX64/ssl, which attempts to load /ReleaseX64/ssl/openssl.cnf that does not exist. A low-privilege user can create C:/ReleaseX64/ssl/openssl.cnf to load a malicious Open...

CVE-2020-36159

Veritas Desktop and Laptop Option DLO before 9.5 disclosed operational information on the backup processing status through a URL that did not require authentication...

ImageMagick: Shell injection via PDF password could result in arbitrary code execution

A flaw was found in ImageMagick. The -authenticate option is mishandled allowing user-controlled password set for a PDF file to possibly inject additional shell commands via coders/pdf.c. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

Veritas Desktop and Laptop Option 访问控制错误漏洞

Veritas Desktop and Laptop Option is a software from Veritas, USA that provides data backup and endpoint protection features for Windows and Mac desktop and laptop computers. The software supports network-less protection, instant backup, customized failover, self-service restore, and other...

Oracle Linux 7 : ImageMagick (ELSA-2021-0024)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0024 advisory. 6.9.10.68-5 - Adding CTV-2020-29599 fix Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

Veritas Desktop and Laptop Option Information Disclosure Vulnerability

Veritas Desktop and Laptop Option is a software from Veritas, USA that provides data backup and endpoint protection features for Windows and Mac desktop and laptop computers. The software supports network-less protection, instant backup, customized failover, self-service restore, and other...

OPENSUSE-SU-2021:0016-1 Security update for privoxy

This update for privoxy fixes the following issues: privoxy was updated to 3.0.29: Fixed memory leaks when a response is buffered and the buffer limit is reached or Privoxy is running out of memory. OVE-20201118-0001 Fixed a memory leak in the show-status CGI handler when no action files are...

CVE-2020-35932

Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...

1E Client Elevation of Privilege Vulnerability

1E Client is an agent-less endpoint management software from 1E 1E Client USA. An elevation of privilege vulnerability exists in 1E Client versions 4.1.0.267 and 5.0.0.745 that allows remote authenticated users and local users to gain elevated privileges via the REPAIR option. This applies to...

CVE-2020-16268

The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via the repair option. This applies to installations that have a TRANSFORM MST with the option to disable the installation of the Nomad module. An attacker may craf...

CVE-2020-16268

The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via the repair option. This applies to installations that have a TRANSFORM MST with the option to disable the installation of the Nomad module. An attacker may craf...

1E Client 权限许可和访问控制问题漏洞

1E Client is an agent-less endpoint management software from 1E 1E Client USA. An elevation of privilege vulnerability exists in 1E Client versions 4.1.0.267 and 5.0.0.745 that allows remote authenticated users and local users to gain elevated privileges via the REPAIR option. This applies to...