SUSE-SU-2021:1455-1 Security update for cifs-utils

This update for cifs-utils fixes the following security issues: - CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container. bsc1183239 - CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs. bsc1174477 This update for cifs-utils fixes the following issue...

SUSE: Security Advisory (SUSE-SU-2014:1658-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:2728-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-22177

Removed by vendor...

VulnCheck KEV: CVE-2018-10823

An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip...

NEC Multiple Products Operating System Command Injection Vulnerability

The NEC UNIVERGE SV8500 and NEC UNIVERGE SV9500 are both an IP phone device from NEC Corporation of Japan. A security vulnerability exists in multiple NEC products that could allow a remote attacker to execute arbitrary shell commands on the target system. The following products and versions are...

CVE-2020-12149

The configuration backup/restore function in Silver Peak Unity ECOSTM ECOS appliance software was found to directly incorporate the user-controlled config filename in a subsequent shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. This...

CVE-2020-12149

The configuration backup/restore function in Silver Peak Unity ECOSTM ECOS appliance software was found to directly incorporate the user-controlled config filename in a subsequent shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. This...

CVE-2020-12149 OS Command Injection - Management File Upload

The configuration backup/restore function in Silver Peak Unity ECOSTM ECOS appliance software was found to directly incorporate the user-controlled config filename in a subsequent shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. This...

Virtuozzo 7 : patch (VZLSA-2019-2964)

An update for patch is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

SUSE SLED15 / SLES15 Security Update : cifs-utils (SUSE-SU-2020:2729-1)

This update for cifs-utils fixes the following issues : CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs bsc1174477. Fixed an invalid free in mount.cifs; bsc1152930. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

SUSE SLES12 Security Update : cifs-utils (SUSE-SU-2020:2728-1)

This update for cifs-utils fixes the following issues : CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs bsc1174477. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

Remote code execution in dependabot-core branch names when cloning

Impact Remote code execution vulnerability in dependabot-common and dependabot-gomodules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$curl,127.0.0.1", Dependabot will make a HTTP request to...

GHSA-23F7-99JX-M54R Remote code execution in dependabot-core branch names when cloning

Impact Remote code execution vulnerability in dependabot-common and dependabot-gomodules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$curl,127.0.0.1", Dependabot will make a HTTP request to...

Remote code execution in dependabot-core branch names when cloning

Impact Remote code execution vulnerability in dependabot-common and dependabot-gomodules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$curl,127.0.0.1", Dependabot will make a HTTP request to...

Fedora 32 : cifs-utils (2020-cfdd73f1b4)

New upstream release : - fixes CVE-2020-14342 cifs-utils: shell command injection in mount.cifs - adds smb2-quota tool - adds mount.smb3 as a symlink to mount.cifs Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Fedora 33 : cifs-utils (2020-ea0b9caac3)

New upstream release : - fixes CVE-2020-14342 cifs-utils: shell command injection in mount.cifs - adds smb2-quota tool - adds mount.smb3 as a symlink to mount.cifs Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Markdown-supplied Shell Command Execution

Impact lookatme versions prior to 2.3.0 automatically loaded the built-in "terminal" and "fileloader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. Patches Users should upgrade to lookatme versions 2.3.0 or...

GHSA-C84H-W6CR-5V8Q Markdown-supplied Shell Command Execution

Impact lookatme versions prior to 2.3.0 automatically loaded the built-in "terminal" and "fileloader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. Patches Users should upgrade to lookatme versions 2.3.0 or...

lookatme OS Command Injection Vulnerability

lookatme is a terminal-based, interactive pypi codebase for markdown presentations for individual developers. An operating system command injection vulnerability exists in lookatme python/pypi package versions prior to 2.3.0, which can be exploited by an attacker to automatically run malicious...