ASB-A-199191310

Bulletin has no description...

ASB-A-197868577

In osimalloc and osicalloc of allocator.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-190403081

Bulletin has no description...

ASB-A-201430561

Bulletin has no description...

UVI-2021-1002302 thermal: Fix NULL pointer dereferences in of_thermal_ functions

thermal: Fix NULL pointer dereferences in ofthermal functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.81 by commit...

GSD-2021-1002270 ASoC: SOF: Intel: hda-dai: fix potential locking issue

ASoC: SOF: Intel: hda-dai: fix potential locking issue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.162 by commit...

UVI-2021-1002250 tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc

tty: ttybuffer: Fix the softlockup issue in flushtoldisc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.218 by commit...

UVI-2021-1002233 scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()

scsi: lpfc: Fix listadd corruption in lpfcdraintxq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.291 by commit...

DLA-2829-1 libvpx - security update

Bulletin has no description...

JVN#81376414: Multiple vulnerabilities in baserCMS

baserCMS provided by baserCMS Users Community contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2021-41243 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.8 CVSS v2| AV:N/AC:L/Au:S/C:C/I:C/A:C| Base Score: 9.0...

GHSA-C4RH-4376-GFF4 Improper certificate management in AWS IoT Device SDK v2

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority CA to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store...

CVE-2021-37102

The CVE-2021-37102 issue affects Huawei FusionCompute’s CMA service module, where processing the default certificate file allows command injection due to inadequate input validation. Affected versions include FusionCompute 6.0.0, 6.3.0, 6.3.1, 6.5.0, 6.5.1, and 8.0.0. If exploited, an attacker co...

Cross-Site Request Forgery (CSRF)

kevinpapst/kimai2 is vulnerable to cross-site request forgery. An attacker can delete invoice templates through the deleteCommentAction function in CustomerController.php...

ALPINE-CVE-2021-3973

vim is vulnerable to Heap-based Buffer Overflow...

CVE-2021-39236

In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user...

CVE-2021-33480

An use-after-free vulnerability was discovered in gocr through 0.53-20200802 in contextcorrection in pgm2asc.c...

CVE-2021-43975

In the Linux kernel through 5.15.2, hwatlutilsfwrpcwait in drivers/net/ethernet/aquantia/atlantic/hwatl/hwatlutils.c allows an attacker who can introduce a crafted device to trigger an out-of-bounds write via a crafted length value...

GHSA-2CQG-Q7JM-J35C snipe-it is vulnerable to Cross-site Scripting

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Improper Input Validation in pip

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1...

GHSA-5XP3-JFQ3-5Q8X Improper Input Validation in pip

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1...