Double free

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers i.e. the server routes any request, regardless of the HOST header to an October CMS instance the potential exists for Host Header...

NewStart CGSL MAIN 6.02 : gnupg2 Vulnerability (NS-SA-2021-0076)

The remote NewStart CGSL host, running version MAIN 6.02, has gnupg2 packages installed that are affected by a vulnerability: - Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration...

NewStart CGSL MAIN 6.02 : oniguruma Vulnerability (NS-SA-2021-0067)

The remote NewStart CGSL host, running version MAIN 6.02, has oniguruma packages installed that are affected by a vulnerability: - A NULL Pointer Dereference in matchat in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expressio...

NewStart CGSL CORE 5.04 / MAIN 5.04 : cups Multiple Vulnerabilities (NS-SA-2021-0022)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has cups packages installed that are affected by multiple vulnerabilities: - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra...

NewStart CGSL MAIN 6.02 : pcre2 Vulnerability (NS-SA-2021-0070)

The remote NewStart CGSL host, running version MAIN 6.02, has pcre2 packages installed that are affected by a vulnerability: - An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications...

NewStart CGSL MAIN 6.02 : libpq Multiple Vulnerabilities (NS-SA-2021-0085)

The remote NewStart CGSL host, running version MAIN 6.02, has libpq packages installed that are affected by multiple vulnerabilities: - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creat...

NewStart CGSL MAIN 6.02 : python-pip Vulnerability (NS-SA-2021-0081)

The remote NewStart CGSL host, running version MAIN 6.02, has python-pip packages installed that are affected by a vulnerability: - The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a...

NewStart CGSL MAIN 6.02 : spamassassin Multiple Vulnerabilities (NS-SA-2021-0070)

The remote NewStart CGSL host, running version MAIN 6.02, has spamassassin packages installed that are affected by multiple vulnerabilities: - In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the...

NewStart CGSL CORE 5.04 / MAIN 5.04 : OpenEXR Multiple Vulnerabilities (NS-SA-2021-0031)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has OpenEXR packages installed that are affected by multiple vulnerabilities: - An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp...

NewStart CGSL CORE 5.04 / MAIN 5.04 : audiofile Multiple Vulnerabilities (NS-SA-2021-0046)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has audiofile packages installed that are affected by multiple vulnerabilities: - The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an...

NewStart CGSL MAIN 6.02 : spice Vulnerability (NS-SA-2021-0075)

The remote NewStart CGSL host, running version MAIN 6.02, has spice packages installed that are affected by a vulnerability: - Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client...

NewStart CGSL MAIN 4.06 : sudo Multiple Vulnerabilities (NS-SA-2021-0001)

The remote NewStart CGSL host, running version MAIN 4.06, has sudo packages installed that are affected by multiple vulnerabilities: - In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. pwfeedback is a...

NewStart CGSL MAIN 6.02 : firefox Multiple Vulnerabilities (NS-SA-2021-0089)

The remote NewStart CGSL host, running version MAIN 6.02, has firefox packages installed that are affected by multiple vulnerabilities: - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects...

NewStart CGSL MAIN 6.02 : glibc Multiple Vulnerabilities (NS-SA-2021-0069)

The remote NewStart CGSL host, running version MAIN 6.02, has glibc packages installed that are affected by multiple vulnerabilities: - An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not...

Fedora 33 : privoxy (2021-5fb8bd8258)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-5fb8bd8258 advisory. - 3.0.32 FEDORA-2021-5fb8bd8258 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number....

NewStart CGSL MAIN 6.02 : expat Multiple Vulnerabilities (NS-SA-2021-0083)

The remote NewStart CGSL host, running version MAIN 6.02, has expat packages installed that are affected by multiple vulnerabilities: - In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and...

NewStart CGSL CORE 5.04 / MAIN 5.04 : python Vulnerability (NS-SA-2021-0015)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python packages installed that are affected by a vulnerability: - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpa...

CVE-2021-21480

SAP MII allows users to create dashboards and save them as JSP through the SSCE Self Service Composition Environment. An attacker can intercept a request to the server, inject malicious JSP code in the request and forward to server. When this dashboard is opened by users having at least SAPXMII...

RHEL 7 : nss-softokn (RHSA-2021:0758)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0758 advisory. The nss-softokn package provides the Network Security Services Softoken Cryptographic Module. Security Fixes: nss: Use-after-free in...

SAP MII 代码注入漏洞

SAP MII is a software application from SAP Germany. It provides manufacturing operations management functions. SAP MII has a security vulnerability. sapmii allows users to create dashboards via SSCE Self Service Combined Environment and save them as JSPs. an attacker can intercept requests to the...