CVE-2021-2307 affecting package mysql 8.0.23-1

CVE-2021-2307 affecting package mysql 8.0.23-1. An upgraded version of the package is available that resolves this issue...

CVE-2019-12855 affecting package python-twisted 19.2.1-5

CVE-2019-12855 affecting package python-twisted 19.2.1-5. An upgraded version of the package is available that resolves this issue...

CVE-2020-27783 affecting package python-lxml 4.2.4-7

CVE-2020-27783 affecting package python-lxml 4.2.4-7. An upgraded version of the package is available that resolves this issue...

CVE-2018-19787 affecting package python-lxml 4.2.4-7

CVE-2018-19787 affecting package python-lxml 4.2.4-7. An upgraded version of the package is available that resolves this issue...

CVE-2021-29148

A local cross-site scripting XSS vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series versions: Aruba AOS-CX firmware: 10.04.xxxx ...

CVE-2021-31525 affecting package golang 1.15.11-1

CVE-2021-31525 affecting package golang 1.15.11-1. An upgraded version of the package is available that resolves this issue...

Unchecked hostname resolution could allow access to local network resources by users outside the local network

Impact A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This...

GHSA-6RG3-8H8X-5XFV Unchecked hostname resolution could allow access to local network resources by users outside the local network

Impact A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This...

CVE-2021-20197 affecting package binutils 2.32-5

CVE-2021-20197 affecting package binutils 2.32-5. An upgraded version of the package is available that resolves this issue...

CVE-2021-29621

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version...

CVE-2018-1000110 affecting package git 2.23.3-1

CVE-2018-1000110 affecting package git 2.23.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2020-25685 affecting package dnsmasq 2.79-11

CVE-2020-25685 affecting package dnsmasq 2.79-11. An upgraded version of the package is available that resolves this issue...

CVE-2020-25686 affecting package dnsmasq 2.79-11

CVE-2020-25686 affecting package dnsmasq 2.79-11. An upgraded version of the package is available that resolves this issue...

CVE-2005-2069 affecting package openldap 2.4.50-1

CVE-2005-2069 affecting package openldap 2.4.50-1. An upgraded version of the package is available that resolves this issue...

Security Bulletin: IBM Security Verify Information Queue uses a Node.js package with a cross-site scripting vulnerability (CVE-2020-7676)

Summary The web server in IBM Security Verify Information Queue ISIQ uses an older version of the angular.js package that has a cross-site scripting vulnerability. As of v10.0.0, ISIQ has upgraded to a newer, secure version of angular.js. Vulnerability Details CVEID: CVE-2020-7676 DESCRIPTION:...

Security Bulletin: Multiple vulnerabilities in GNU binutils affect IBM Netezza Analytics

Summary GNU binutils is used by IBM Netezza Analytics. IBM Netezza Analytics has addressed the applicable CVEs by upgrading GNU binutils to latest version 2.35. Vulnerability Details CVEID: CVE-2020-35495 DESCRIPTION: GNU Binutils is vulnerable to a denial of service, caused by NULL pointer...

ALSA-2020:5620 Important: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream version: postgresql 12.5. Security Fixes: postgresql: Reconnection can downgrade connection security settings CVE-2020-25694 postgresql: Multiple features...

Moderate: Red Hat Security Advisory: rh-eclipse security, bug fix and enhancement update

Updated rh-eclipse packages are now available as a part of Red Hat Developer Tools for Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Cross-Site Scripting in scratch-svg-renderer

Overview This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function. Recommendation Upgrade to version...

Man-in-the-middle (MitM)

Firefox is vulnerable to man-in-the-middle MitM. The Upgrade-Insecure-Requests UIR specification states that if UIR is enabled through Content Security Policy CSP, navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the...