UBUNTU-CVE-2021-21319

Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround this is the default state...

Galette 跨站脚本漏洞

Galette is open source a membership management web application for non-profit organizations. Galette suffers from a cross-site scripting vulnerability in versions prior to 0.9.5 that stems from a lack of checksum filtering of user-supplied and output data. An attacker could store malicious...

The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur.

...

Ubuntu 20.04 LTS : Linux kernel (Azure) vulnerabilities (USN-5120-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5120-1 advisory. It was discovered that the f2fs file system in the Linux kernel did not properly validate metadata in some situations. An attacker could use this to...

Oracle MySQL Connectors (October 2021 CPU)

The 8.0.26 and prior versions of MySQL Connectors installed on the remote host are affected by a vulnerability as referenced in the October 2020 CPU advisory. A Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 8.0.26 an...

RHEL 8 : OpenShift Container Platform 4.8.15 (RHSA-2021:3820)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3820 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

Six paths to a job in cybersecurity

Like many high-tech businesses, the cybersecurity industry is facing a widening skills gap. One of the main reasons why many companies do not have effective data security practices is the lack of actual skilled cybersecurity practitioners. In a November 2019 report, the International Information...

Oracle Primavera Unifier (Oct 2021 CPU)

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory, including the following: - An easily exploitable vulnerability in the File Management component of Primavera Unifier that allows an unauthenticated...

SUSE SLES12: strongswan / strongswan-doc / strongswan-hmac / strongswan-ipsec / etc (SUSE-SU-2021:3468-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3468-1 advisory. - CVE-2021-41991: Fixed an integer overflow when replacing certificates in cache. bsc1191435 Tenable has extracted the preceding description...

CVE-2021-38486

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the internal network to...

CVE-2021-38486

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the internal network to...

Code injection

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the internal network to...

CVE-2021-38486

InHand Networks IR615 Router vulnerable via CVE-2021-38486 due to improper authorization in the cloud portal, enabling self-registration without account creation and potentially full control of the device and code execution in the internal network. Affected versions per trusted advisory: IR615 Ro...

CVE-2021-38486 InHand Networks IR615 Router

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the internal network to...

PT-2021-22160 · Inhand Networks · Inhand Networks Ir615 Router

Name of the Vulnerable Software and Affected Versions: InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870 Description: The issue allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control...

Google Chrome < 95.0.4638.54 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 95.0.4638.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 202110stable-channel-update-for-desktop19 advisory. - Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54...

AZL-6896 CVE-2021-41990 affecting package strongswan for versions less than 5.9.5-1

The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur...

CVE-2021-41990

The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur...

strongSwan 输入验证错误漏洞

strongSwan is a Swiss Andreas Steffen personal developer of a Linux platform to use the open source IPsec-based VPN solution. The solution includes authentication mechanisms such as X.509 public key certificates, secure storage of private keys, and smart cards. An input validation error...

WordPress MPL-Publisher – Self-publish your book & ebook plugin <= 1.30.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Thinkland Security Team in WordPress MPL-Publisher – Self-publish your book & ebook plugin versions = 1.30.2. Solution Update the WordPress MPL-Publisher – Self-publish your book & ebook plugin to the latest available versi...