OPENSUSE-SU-2021:1045-1 Security update for claws-mail

This update for claws-mail fixes the following issues: Update to 3.18.0 Support for the OAuth2 authorisation protocol has been added for IMAP, POP and SMTP using custom, user-generated client IDs. OAuth2 preferences are found in the Account Preferences on the Receive page for POP: Authenticate...

CVE-2021-22867 Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server

A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files on the GitHub Enterprise Server...

Current Book <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitize user input when an authenticated user adds Author or Book Title, then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue. 1. Install WordPress 5.7.2 2. Install and activate Custom Book 3...

MGASA-2021-0342 Updated freeradius packages fix security vulnerabilities

Moved logrotate options into specific parts for each log as "global" options will persist past and clobber global options in the main logrotate config bsc1180525. Fixed plaintext password entries in logfiles bsc1184016. The freeradius package has been updated to version 3.0.22, fixing these issue...

PT-2024-11308 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a NULL dereference in the cifs compose mount options function. The optional @ref parameter might contain a NULL node name, which could lead to a NULL dereferenc...

Gorsair - Hacks Its Way Into Remote Docker Containers That Expose Their APIs

Gorsair is a penetration testing tool for discovering and remotely accessing Docker APIs from vulnerable Docker containers. Once it has access to the docker daemon, you can use Gorsair to directly execute commands on remote containers. Exposing the docker API on the internet is a tremendous risk,...

CVE-2020-36410

A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Email address to receive notification of news submission" parameter under the "Options" module...

Cross site scripting

A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Email address to receive notification of news submission" parameter under the "Options" module...

Command Injection

Overview gitlogplus is a Git log parser for Node.JS Affected versions of this package are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization. PoC by Rafal Janicki 1. Run npm i gitlogplus 2. Run mkdir gi...

CMS Made Simple 跨站脚本漏洞

CMS Made Simple CMSMS is an open source content management system that provides developers, programmers, and website owners with a web-based version of the development and management interface. A stored cross-site scripting vulnerability exists in CMS Made Simple version 2.2.14, which can be...

Microsoft exec reveals “routine” secrecy orders from government investigators

Microsoft executive Tom Burt told Congressional lawmakers Wednesday that Federal law enforcement agencies send “routine” secret orders for customer information from the Seattle-based company, numbering anywhere from 2,400 to 3,500 such requests a year. “While the recent news about secret...

GSD-2021-1001062 mptcp: Fix out of bounds when parsing TCP options

mptcp: Fix out of bounds when parsing TCP options This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.13 by commit...

UVI-2021-1001062 mptcp: Fix out of bounds when parsing TCP options

mptcp: Fix out of bounds when parsing TCP options This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.13 by commit...

GSD-2021-1001061 netfilter: synproxy: Fix out of bounds when parsing TCP options

netfilter: synproxy: Fix out of bounds when parsing TCP options This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.13 by commit...

UVI-2021-1001061 netfilter: synproxy: Fix out of bounds when parsing TCP options

netfilter: synproxy: Fix out of bounds when parsing TCP options This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.13 by commit...

GSD-2021-1000983 sch_cake: Fix out of bounds when parsing TCP options and header

schcake: Fix out of bounds when parsing TCP options and header This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.46 by commit...

UVI-2021-1000982 mptcp: Fix out of bounds when parsing TCP options

mptcp: Fix out of bounds when parsing TCP options This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.46 by commit...

GSD-2021-1000981 netfilter: synproxy: Fix out of bounds when parsing TCP options

netfilter: synproxy: Fix out of bounds when parsing TCP options This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.46 by commit...

UVI-2021-1000981 netfilter: synproxy: Fix out of bounds when parsing TCP options

netfilter: synproxy: Fix out of bounds when parsing TCP options This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.46 by commit...

GSD-2021-1000920 sch_cake: Fix out of bounds when parsing TCP options and header

schcake: Fix out of bounds when parsing TCP options and header This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.128 by commit...