AlmaLinux 8 : exiv2 (ALSA-2020:1577)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:1577 advisory. exiv2: infinite loop and hang in Jp2Image::readMetadata in jp2image.cpp could lead to DoS CVE-2019-20421 exiv2: null pointer dereference in the...

Emerson DeltaV Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2012-3035)

Buffer overflow in Emerson DeltaV 9.3.1 and 10.3 through 11.3.1 allows remote attackers to cause a denial of service daemon crash via a long string to an unspecified port. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

CVE-2021-34884

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within th...

Office Online Server Information Representation Spear Phishing

The vulnerability of the Office Online Server web server is related to errors in information representation by the user interface. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks remotely...

ROS-2-1695

2.1695 Denial of Service in Libxml2 CVE-2021-3541 1. Vulnerability Description: The vulnerability allows a remote attacker to perform a denial of service DoS attack. The vulnerability exists due to insufficient validation of user input. A remote attacker can pass specially crafted input data to a...

Software flaws in walk-through metal detectors made them hackable

By Waqas Walk-through metal detectors manufactured by well-known U.S.-based firm Garett are vulnerable to remote attacks. This is a post from HackRead.com Read the original post: Software flaws in walk-through metal detectors made them hackable...

Microsoft Edge iOS Authentication Bypass Spoofing

The vulnerability of Microsoft Edge browser on the iOS operating system is related to the ability to bypass authentication through spoofing. Exploiting this vulnerability allows a malicious actor to carry out spoofing attacks remotely...

Cisco Identity Services Engine XSS

The vulnerability in the web interface of the Cisco Identity Services Engine exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Microsoft Exchange Server Spear Phishing

The vulnerability of Microsoft Exchange Server servers is related to errors in information representation by the user interface. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks remotely...

[SECURITY] [DLA 2833-1] rsync security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2833-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk November 30, 2021 https://wiki.debian.org/LTS -...

Wireshark Input Validation Error Vulnerability (CNVD-2021-91421)

Wireshark is a suite of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis.Wireshark suffers from an input validation error vulnerability that stems from insufficient validation in the Modbu...

Sql injection

A SQL injection issue in pages/editfields/9ajax/addkeyword.php of ResourceSpace 9.5 and 9.6 rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user...

CVE-2021-43396

In iconvdata/iso-2022-jp-3.c in the GNU C Library aka glibc 2.34, remote attackers can force iconv to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv use cases. NOTE: the vendor states "t...

CVE-2021-37989

Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page...

PT-2021-4433 · Microsoft · Dynamics 365 Customer Engagement

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 Customer Engagement affected versions not specified Description: The issue is related to insufficient protection of the web page structure, allowing for cross-site scripting attacks. An attacker can exploit this by usin...

Security Bulletin: Multiple vulnerabilities in Bouncy Castle Java Cryptography affect IBM Tivoli Business Manager

Summary Bouncy Castle Java Cryptography is shipped as part of IBM Tivoli Business Manager 6.2.0. Information about security vulnerabilities affecting Bouncy Castle Java Cryptography has been published in a security bulletin. Vulnerability Details CVEID: CVE-2018-5382 DESCRIPTION: Bouncy Castle...

CVE-2021-41296

ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system...

USN-5090-3 apache2 regression

USN-5090-1 fixed vulnerabilities in Apache HTTP Server. One of the upstream fixes introduced a regression in UDS URIs. This update fixes the problem. Original advisory details: James Kettle discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain crafted methods. A remote...

CVE-2021-20035

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS...

CVE-2020-19146

CVE-2020-19146 affects Jfinal CMS versions 4.7.1 and earlier, where an improper access control flaw in the component jfinal_cms/admin/folder/list allows remote attackers to obtain sensitive information via the TemplatePath parameter. Root cause: insufficient access checks on the affected path. Im...