Fedora 33 : screen (2021-9107eeb95c)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-9107eeb95c advisory. - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service invalid write access and application crash or possibly...

CVE-2021-23344

The package total.js before 3.4.8 are vulnerable to Remote Code Execution RCE via set...

CVE-2021-23347

CVE-2021-23347 affects the Argo CD project, specifically the command line interface in the package github.com/argoproj/argo-cd/cmd before 1.7.13, and in 1.8.0 up to before 1.8.6. The underlying issue is a Cross-site Scripting (XSS) vulnerability triggered when the SSO provider returns a malicious...

Huawei EulerOS: Security Advisory for webkitgtk3 (EulerOS-SA-2021-1371)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-23342 Cross-site Scripting (XSS)

This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1 When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking plac...

PYSEC-2021-146

All versions of package reportlab are vulnerable to Server-side Request Forgery SSRF via img tags. In order to reduce risk, use trustedSchemes & trustedHosts see in Reportlab's documentation Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos ...

Design/Logic Flaw

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require'three' function buildblank n var ret = "rgb" for var i = 0; i n; i++ ret += " " return ret + ""; var Color = three.Color var time = Date.now; new Colorbuildblank50000 var...

Debian: Security Advisory (DSA-4852-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-23335

All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure...

CVE-2021-23335

CVE-2021-23335 affects the npm package is-user-valid (Node.js). The vulnerability is an LDAP Injection in the authentication logic, enabling potential authentication bypass or information exposure. The IBM bulletin confirms the CVE is acknowledged across IBM Cloud Pak for Data components (no expl...

Fedora 32 : 1:java-1.8.0-openjdk (2021-4cebc3aff9)

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-4cebc3aff9 advisory. - New in release OpenJDK 8u282 2021-01-19 Live versions of these release notes can be found at: https://bitly.com/openjdk8u282...

Fedora 33 : 1:java-1.8.0-openjdk (2021-09272cf059)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-09272cf059 advisory. - New in release OpenJDK 8u282 2021-01-19 Live versions of these release notes can be found at: https://bitly.com/openjdk8u282...

Code injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

Command injection

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package...

Design/Logic Flaw

This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file...

Design/Logic Flaw

This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some case...

Command injection

All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId...

CentOS 8 : targetcli (CESA-2020:1933)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1933 advisory. - targetcli: world writable /var/run/targetclid.sock allows unprivileged user to execute commands CVE-2020-10699 Note that Nessus has not tested for this issue...

CVE-2021-23329

The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below...

Steam Socialite Provider v1 does not correctly validate openid server

Impact The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from steamcommunity.com, allowing a malicious actor to substitute their own openID server. Patches This vulnerability only affects the outdated v1.x versions of the package. These are no longer...