RLSA-2021:4324 Moderate: python-psutil security update

psutil is a module providing an interface for retrieving information on all running processes and system utilization CPU, memory, disks, network, users in a portable way by using Python. Security Fixes: python-psutil: double free because of refcount mishandling CVE-2019-18874 For more details abo...

CVE-2016-2124

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required...

CVE-2021-29753

IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval...

Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability

Citrix StoreFront Server contains an XML External Entity XXE processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information...

SaltStack Salt Authentication Bypass Vulnerability

SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/...

CVE-2021-42557

In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials...

Authentication flaw

In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials...

CVE-2021-34794

A vulnerability in the Simple Network Management Protocol version 3 SNMPv3 access control functionality of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to query SNMP data. This vulnerability is due t...

Kubernetes: Ingress-nginx annotation injection allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces

I submitted the following report to [email protected]: I've been exploring CVE-2021-25742 and believe I've discovered a variant although it appears there may be many. Most template variables are not escaped properly in nginx.tmpl, leading to injection of arbitrary nginx directives. For...

Server-Side Request Forgery (SSRF) in zmister2016/mrdoc

Description ● SSRF in /uploaddocimg/, an attacker could abuse url to visit any intranet in the envioronment of MrDoc server, casuing breaking the border of network. ● Depending on the different env, it could leak sensitive meta-data，according to...

CVE-2020-19957

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dlprint.php page...

CVE-2020-19959

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dlsendmail.php page cookie...

CVE-2020-19960

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dlsendsms.php page cookie...

CVE-2020-19957

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dlprint.php page...

CVE-2020-19961

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php...

Sql injection

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php...

Sql injection

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dlprint.php page...

CVE-2020-19957

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dlprint.php page...

CVE-2020-19957

ZZCMS 2019 is affected by a SQL injection vulnerability in the /dl/dl_print.php page, exploitable via the id parameter to retrieve sensitive data. The root cause is missing validation of externally entered SQL statements in ZZCMS, leading to potential data leakage. Affected product/version: ZZCMS...

CVE-2020-19959

CVE-2020-19959 affects ZZCMS 2019. A SQL injection in the /dl/dl_sendmail.php page cookie dlid parameter can allow an attacker to retrieve sensitive data. The issue is documented across multiple sources confirming the vulnerability in ZZCMS 2019 with SQLi via a cookie field; exploitation details ...