PT-2021-15465 · Tyk · Tyk-Identity-Broker

Name of the Vulnerable Software and Affected Versions: tyk-identity-broker versions prior to 1.1.1 Description: The issue is related to Authentication Bypass via the Go XML parser, which can cause SAML authentication bypass. This occurs because the XML parser does not guarantee integrity in the X...

PT-2021-5288 · Apple · Ipados +4

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.3 iOS versions prior to 14.5 iPadOS versions prior to 14.5 watchOS versions prior to 7.4 tvOS versions prior to 14.5 Description: A parsing issue in the handling of directory paths was addressed with improved path...

PasswordState password manager’s update hijacked to drop malware

By Habiba Rashid The customers were warned through an email that confirmed that the PasswordState software update feature had been compromised. This is a post from HackRead.com Read the original post: PasswordState password managers update hijacked to drop malware...

DLA-2639-1 opendmarc - security update

Bulletin has no description...

OPENSUSE-SU-2021:0607-1 Security update for ruby2.5

This update for ruby2.5 fixes the following issues: - Update to 2.5.9 - CVE-2021-28965: XML round-trip vulnerability in REXML bsc1184644 This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2021:0606-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2021-20309: Division by zero in WaveImage of MagickCore/visual-effects. bsc1184624 - CVE-2021-20311: Division by zero in sRGBTransformImage in MagickCore/colorspace.c bsc1184626 - CVE-2021-20312: Integer overflow in WriteTHUMBNAILImage...

PT-2021-2780 · Cscape · Cscape

Name of the Vulnerable Software and Affected Versions: Cscape versions prior to 9.90 SP4 Description: The issue is related to insufficient validation of user-supplied data when parsing project files, potentially leading to memory corruption. This could allow an attacker to execute code in the...

PT-2021-12636 · Avaya · Avaya Session Border Controller For Enterprise

Name of the Vulnerable Software and Affected Versions: Avaya Session Border Controller for Enterprise versions 7.x through 8.1.1.x Description: A command injection issue could allow an authenticated, remote attacker to send specially crafted messages and execute arbitrary commands with the affect...

PT-2021-12945 · Juniper Networks · Paragon Active Assurance Control Center

Name of the Vulnerable Software and Affected Versions: Juniper Networks Paragon Active Assurance Control Center versions prior to 2.35.6 Juniper Networks Paragon Active Assurance Control Center version 2.36 versions prior to 2.36.2 Description: An authentication bypass issue may allow an attacker...

DSA-4898-1 wpa - security update

Bulletin has no description...

BMD BMDWeb 2.0 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Stored Cross Site Scripting Outdated software library product: BMD BMDWeb 2.0 vulnerable version: BMD versions prior to 24.01.21 fixed version: 24.01.21 and 24.02.11 or...

PT-2021-19415 · Mediawiki +1 · Abusefilter Extension +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.35.2 AbuseFilter extension for MediaWiki versions through 1.35.2 Description: An issue in the AbuseFilter extension for MediaWiki allows the page recent contributors to leak the existence of certain deleted...

Cisco SD-WAN vManage Software Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying file system of the device. This vulnerability is due to insufficient file scope limiting. An attacker could exploit this...

PT-2021-10985 · Fast Ber · Fast Ber

Name of the Vulnerable Software and Affected Versions: fast ber versions prior to v0.5 Description: An issue was discovered in the yy::yylex function located in asn compiler.hpp, which has a heap-based buffer over-read. Recommendations: For versions prior to v0.5, update to version v0.5 or later ...

PT-2021-2863 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: The issue is related to errors in the authorization procedure of the Cisco SD-WAN vManage web interface. It allows a remote attacker to gain unauthorized access to...

Security Bulletin: Resilient is affected by the use of a risky or outdated cypher (CVE-2017-1657)

Summary Security Bulletin: Resilient is affected by the use of a risky or outdated cypher CVE-2017-1657 Vulnerability Details Summary Resilient has addressed the vulnerability by using updated cyphers. Vulnerability Details CVEID: CVE-2017-1657 DESCRIPTION: IBM Resilient uses weaker than expected...

OPENSUSE-SU-2021:0588-1 Security update for python-django-registration

This update for python-django-registration fixes the following issues: Update to 3.1.2 boo1184427, CVE-2021-21416 Filter sensitive POST parameters in error reports Fix RemovedInDjango40Warning from Signal arguments...

PT-2021-13473 · Nvidia +2 · Nvidia Gpu Display Driver +2

Name of the Vulnerable Software and Affected Versions: NVIDIA GPU Display Driver versions R450 through R460 Description: The issue arises from the software's incorrect update of a reference count used to manage a resource, potentially leading to denial of service. Recommendations: For versions R4...

SUSE: Security Advisory (SUSE-SU-2017:2264-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2021-14319 · Fibaro · Fibaro Home Center Lite +1

Name of the Vulnerable Software and Affected Versions: Fibaro Home Center 2 and Lite versions 4.600 and older Description: The issue concerns an internal management service accessible on port 8000, where certain API endpoints can be accessed without authentication. This allows unauthorized action...