GHSA-5FFW-GXPP-MXPF vulnerabilities

Vulnerabilities for packages: ctop...

MGASA-2022-0199 Updated ffmpeg packages fix security vulnerability

This update provides ffmpeg version 4.3.4, which fixes several security vulnerabilities and other bugs which were corrected upstream...

GHSA-HP87-P4GW-J4GQ vulnerabilities

Vulnerabilities for packages: thanos-operator-fips, thanos-operator, dynamic-localpv-provisioner, dynamic-localpv-provisioner-fips...

Malicious code in ual-content-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0e062a5264ae40c85a311a097fdae78c7ea205dd058a5f59f25859075c6c121 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-0611

Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11...

GHSA-X5M6-JH4R-34MV Hub Package Arbitrary File Overwrite

The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file...

MGASA-2022-0049 Updated lrzsz packages fix security vulnerability

lrzsz before version 0.12.21rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a sizet to wrap around. CVE-2018-10195...

Command Injection in node-windows

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter...

Dolibarr has unspecified vulnerabilities

Dolibarr is an application. A modern software package that helps manage your organization's activities. a security vulnerability exists in Dolibarr, which stems from allowing HTML injection in admin limits.php in Dolibarr 7.0.2. No details of the vulnerability are currently available...

SUSE-SU-2021:4161-1 Security update for python-Babel

This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal that may lead to arbitrary locale files loading and arbitrary code execution bsc1185768...

Hitachi Energy PCM600 Update Manager

1. EXECUTIVE SUMMARY CVSS v3 6.7 Vendor: Hitachi Energy Equipment: PCM600 Update Manager Vulnerability: Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to bypass the certificate validation and install an untrusted software...

Airangel Hsmx Gateway Remote Code Execution Vulnerability

Airangel Hsmx Gateway is a platform from Airangel UK, Inc. It is used to manage authentication and billing in the network.A remote code execution vulnerability exists in Airangel Hsmx Gateway prior to 5.2.04, which originates when a remote server controlled by an attacker downloads and runs a...

CVE-2021-23390

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set and U.get functions...

MGASA-2021-0290 Updated leptonica packages fix security vulnerabilities

Leptonica before 1.80.0 allows a denial of service application crash via an incorrect left shift in pixConvert2To8 in pixconv.c CVE-2020-36277. Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c CVE-2020-36278. Leptonica before 1.80.0 allows a heap-bas...

MGASA-2021-0261 Updated openssh packages fix a security vulnerability

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host CVE-2021-28041...

GHSA-P2J5-3F4C-224R Improper Input Validation in HashiCorp Consul

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. Specific Go Packages Affected github.com/hashicorp/consul/agent...

MGASA-2021-0158 Updated fwupd packages fix a security vulnerability

A PGP signature bypass was found in fwupd, which could lead to possible installation of unsigned firmware CVE-2020-10759...

DEBIAN-CVE-2021-27290

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option...

CVE-2021-21327

GLPI before 9.5.4 allows non-authenticated remote instantiation of any class via Unsafe Reflection in getItemForItemtype(), enabling class constructors/destructors to run and potentially corrupt integrity of the core platform and plugins through a POP chain. Vulnerable component: GLPI core/runtim...

Huawei AIS-BW80H-00 Input Validation Error Vulnerability

Huawei AIS-BW80H-00 is a smart speaker device from Huawei China. Huawei AIS-BW80H-00 is vulnerable to an input validation error, which could be exploited by an attacker to load a crafted software package onto the device...