CVE-2021-33689

When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator Administrator applications, version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted...

Multiple Low Security Issues in Mozilla VPN — Mozilla

Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit...

Advisory ROSA-SA-2021-1914

Software: mariadb 5.5.68 OS: Cobalt 7.9 CVE-ID: CVE-2016-3492 CVE-Crit: MEDIUM CVE-DESC: An unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors associated with Server:...

First American Financial Pays Farcical $500K Fine

In May 2019, KrebsOnSecurity broke the news that the website of mortgage settlement giant First American Financial Corp. NYSE:FAF was leaking more than 800 million documents -- many containing sensitive financial data -- related to real estate transactions dating back 16 years. This week, the U.S...

File Upload Vulnerability in SecFox Security Audit System

SecFox Security Audit System is a security audit system of NetShen Information Technology Beijing Co. A file upload vulnerability exists in SecFox Security Audit System, which can be exploited by attackers to gain control of the server...

Information Disclosure Vulnerability in Built-in Reports of Renzi Network Security Audit System

Ltd. is the most comprehensive provider of large-scale cyberspace security protection solutions in China. There is an information leakage vulnerability in the built-in report of Renzihang Network Security Audit System, which can be exploited by an attacker to obtain the login password and log int...

Squid 4.0.1 < 4.14, 5.0.1 < 5.0.5 DoS Vulnerability (GHSA-jjq6-mh2h-g39h, SQUID-2021:2)

Squid is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:squid-cache:squid";...

Squid 2.5.STABLE2 < 4.15, 5.0.1 < 5.0.6 Multiple DoS Vulnerabilities (GHSA-pxwq-f3qr-w2xf, SQUID-2021:4)

Squid is prone to multiple denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

opencontainers runc contains procfs race condition with a shared volume mount

Impact By crafting a malicious root filesystem with /proc being a symlink to a directory which was inside a volume shared with another running container, an attacker in control of both containers can trick runc into not correctly configuring the container's security labels and not correctly maski...

GHSA-C52F-PQ47-2R9J plugin.yaml file allows for duplicate entries in helm

Impact During a security audit of Helm's code base, Helm maintainers identified a bug in which a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install...

plugin.yaml file allows for duplicate entries in helm

Impact During a security audit of Helm's code base, Helm maintainers identified a bug in which a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install...

GHSA-JM56-5H66-W453 Repository index file allows for duplicates of the same chart entry in helm

Impact During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs...

Repository index file allows for duplicates of the same chart entry in helm

Impact During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs...

GHSA-9VP5-M38W-J776 Aliases are never checked in helm

Impact During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart. Patches This issue has been patched in Helm 3.3.2 a...

Command Execution Vulnerability in Renzihang Cloud Ops Security Audit System

RENZHOU Cloud O&M Security Audit System is a powerful support platform for enterprise and public utility IT systems' internal pre-prevention, mid-monitoring, and post-auditing. A command execution vulnerability exists in RENZIHANG Cloud O&M Security Audit System, which can be exploited by attacke...

Critical RCE Bug Found in Homebrew Package Manager for macOS and Linux

A recently identified security vulnerability in the official Homebrew Cask repository could have been exploited by an attacker to execute arbitrary code on users' machines that have Homebrew installed. The issue, which was reported to the maintainers on April 18 by a Japanese security researcher...

LOGBASE Operations Security Management System suffers from weak password vulnerability

LogBase O&M Security Management System is a new generation of operational behavior management security audit system. A weak password vulnerability exists in the LOGBASE Operations and Maintenance Security Management System. The vulnerability is due to the system is not set up for the first login ...

CVE-2021-3473

An internal product security audit of Lenovo XClarity Controller XCC discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator LXCA is used to perform the backup/restore. The backup/restore password typically exists...

Default credentials

An internal product security audit of Lenovo XClarity Controller XCC discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator LXCA is used to perform the backup/restore. The backup/restore password typically exists...

CVE-2021-3473

CVE-2021-3473 affects Lenovo XClarity Controller (XCC). An internal security audit found that during LXCA-assisted backup/restore, the XCC configuration backup/restore password may be written to an internal log buffer and briefly persist (typically