August 10, 2021—KB5005095 (Security-only update)

None None...

August 10, 2021—KB5005043 (OS Build 14393.4583) - EXPIRED

None None...

August 10, 2021—KB5005076 (Monthly Rollup)

None None...

ALBA-2021:3068 esc bug fix and enhancement update

The esc packages contain the Enterprise Security Client ESC, which allows the user to manage security smart cards. The primary function of the tool is to enroll smart cards, so that they can be used for common cryptographic operations, such as to secure e-mail and website access. Bug Fixes and...

CVE-2020-36433

An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement...

CVE-2020-36441

An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox with no requirement for T: Send and T: Sync...

CVE-2021-38166

In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAPSYSADMIN capability...

CVE-2021-36934

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists ACLs on multiple system files, including the Security Accounts Manager SAM database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An...

UBUNTU-CVE-2021-32751

Gradle is a build tool with a focus on build automation. In versions prior to 7.2, start scripts generated by the application plugin and the gradlew script are both vulnerable to arbitrary code execution when an attacker is able to change environment variables for the user running the script. Thi...

CSRF vulnerabilities in requests

requests 2.2.12 and earlier does not require POST requests to request and apply changes, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers to create requests and/or have administrators apply pending requests, like renaming or deleting jobs, deleti...

openSUSE: Security Advisory for salt (openSUSE-SU-2021:0899-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PT-2021-8242 · Rockwell Automation · Rockwell Automation Arena

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Arena affected versions not specified Description: A third-party vulnerability exists in the Rockwell Automation Arena that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If...

CVE-2021-34825

Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system...

Quassel 安全漏洞

Quassel Quassel IRC is a graphical, distributed, cross-platform IRC client. A security vulnerability exists in Quassel 0.13.1, which stems from launching without SSL or TLS support when --require-ssl is enabled, if an available X.509 certificate cannot be found on the local system...

SUSE: Security Advisory (SUSE-SU-2020:3737-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MINTHCM Weak Password Requirement Vulnerability

MINTHCM is a MINTHCM open source application. A human resource management software. A weak password requirement vulnerability exists in the Create New User function in MintHCM RELEASE version 3.0.8, which can be exploited by an attacker to brute-force password cracking...

PT-2021-19950 · Unknown · Express-Hbs

Name of the Vulnerable Software and Affected Versions: express-hbs affected versions not specified Description: The issue arises from express-hbs mixing pure template data with engine configuration options through the Express render API, potentially leading to file disclosure vulnerabilities in...

PT-2021-14695 · Jenkins · Jenkins Xray - Test Management For Jira Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Xray - Test Management for Jira Plugin versions 2.4.0 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained...

CVE-2021-29499

SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. A patch is available in version...

UBUNTU-CVE-2021-29499

SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. A patch is available in version...