November 14, 2021—KB5008602(OS Build 17763.2305) Out-of-band

None None...

KB5008606: Authentication fails on domain controllers in certain Kerberos scenarios on Windows Server 2008 SP2

KB5008606: Authentication fails on domain controllers in certain Kerberos scenarios on Windows Server 2008 SP2 Summary This update addresses the following issue: Addresses a known issue that might cause authentication failures related to Kerberos tickets you acquired from Service for User to Self...

Debian DSA-5006-1 : postgresql-11 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5006 advisory. Jacob Champion discovered two vulnerabilities in the PostgreSQL database system, which could result in man-in-the-middle attacks. For the oldstable distribution...

Ubuntu 18.04 LTS / 20.04 LTS : PostgreSQL vulnerabilities (USN-5145-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5145-1 advisory. Jacob Champion discovered that PostgreSQL incorrectly handled SSL certificate verification and encryption. A remote attacker could possibly u...

Judge.me : Self-XSS due to image URL can be eploited via XSSJacking techniques in review email

A self-XSS vulnerability was discovered in Judge.me due to the image URL of recommendations in the reviewer profile that could be exploited via XSSJacking techniques in the review email. An attacker could insert a payload in the image URL of recommendations and then use XSSJacking techniques to...

RHEL 8 : mutt (RHSA-2021:4181)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4181 advisory. Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and...

CentOS 8 : python36:3.6 (CESA-2021:4150)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4150 advisory. - python-pygments: Infinite loop in SML lexer may lead to DoS CVE-2021-20270 - python-pygments: ReDoS in multiple lexers CVE-2021-27291 Note that Nessu...

RHEL 8 : babel (RHSA-2021:4201)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4201 advisory. Babel provides tools to build and work with gettext message catalogs, and a Python interface to the CLDR Common Locale Data Repository,...

RHEL 8 : pcs (RHSA-2021:4142)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4142 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. The following packages have been...

RHEL 8 : jasper (RHSA-2021:4235)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4235 advisory. JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard. Security Fixes: jasper: Heap-based buffer overflow in...

openSUSE 15 Security Update : binutils (openSUSE-SU-2021:3643-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:3643-1 advisory. - A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger...

CVE-2021-39412

Multiple Cross Site Scripting XSS vulnerabilities exists in PHPGurukul Shopping v3.1 via the 1 callback parameter in a serverside/scripts/idjsonp.php, b serverside/scripts/jsonp.php, and c scripts/objectsjsonp.php, the 2 value parameter in examplessupport/editableajax.php, and the 3 PHPSELF...

PyRDP - RDP Monster-In-The-Middle (Mitm) And Library For Python With The Ability To Watch Connections Live Or After The Fact

PyRDP is a Python Remote Desktop Protocol RDP Monster-in-the-Middle MITM tool and library. It features a few tools: RDP Monster-in-the-Middle Logs credentials used when connecting Steals data copied to the clipboard Saves a copy of the files transferred over the network Crawls shared drives in th...

Cisco Unified Communications Manager Path Traversal (cisco-sa-cucm-path-trav-dKCvktvO)

According to its self-reported version, the Self Care Portal of Cisco Unified Communications Manager Unified CM is affected by a path traversal vulnerability in its web-based management interface due to a failure to properly validate user input. An authenticated, remote attacker can exploit this,...

Huawei HarmonyOS infinite self-recursive vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a microkernel-based distributed operating system. Huawei HarmonyOS is vulnerable to an infinite self-recursive vulnerability, which could be exploited by local attackers to cause a kernel dump...

GHSA-X24J-87X9-JVV5 Publify `guest` role users can self-register even when the admin does not allow it

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. guest role users can self-register even when the admin does not allow it. This happens due to front-end restriction only...

Publify `guest` role users can self-register even when the admin does not allow it

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. guest role users can self-register even when the admin does not allow it. This happens due to front-end restriction only...

Privilege Escalation

publifycore is vulnerable to privilege escalation. The vulnerability exists due to the front-end restrictions. A malicious user with a guest role can self-register, even if the admin does not allow it...

Improper Authorization in Publify

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. guest role users can self-register even when the admin does not allow. This happens due to front-end restriction only...

VulnCheck KEV: CVE-2021-23874

McAfee Total Protection MTP contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense...