Script injection

Impact A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is...

GHSA-GG96-F8WR-P89F Script injection

Impact A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limite...

Script injection

Impact A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limite...

Google to Let Android Users Opt-Out to Stop Ads From Tracking Them

Google is tightening its privacy practices that could make it harder for apps on Android phones and tablets to track users who have opted out of receiving personalized interest-based ads. The change will go into effect sometime in late 2021. The development, which mirrors Apple's move to enable...

Google Chrome to Help Users Identify Untrusted Extensions Before Installation

Google on Thursday said it's rolling out new security features to Chrome browser aimed at detecting suspicious downloads and extensions via its Enhanced Safe Browsing feature, which it launched a year ago. To this end, the search giant said it will now offer additional protections when users...

CVE-2021-32660 TechDocs content sanitization bypass

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of @backstage/tehdocs-common prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

Now Available: EdgeKV Distributed Key-Value Store

We're excited to announce the availability of EdgeKV, a distributed key-value store database that enables EdgeWorkers to leverage data stored at the edge when deploying custom code across our serverless computing platform...

CVE-2021-32625

Redis 6.0+ contains an integer overflow in STRALGO LCS that can corrupt the heap and may lead to remote code execution. This is a follow-up to an incomplete fix for CVE-2021-29477. The issue affects 64‑bit systems and can be mitigated by ACLs preventing STRALGO LCS or by configuring proto-max-bul...

CVE-2020-24862

The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via the /medical/inventories.php path which allows attackers to retrieve all databases...

Sql injection

The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via the /medical/inventories.php path which allows attackers to retrieve all databases...

CVE-2020-24862

The CVE-2020-24862 entry concerns Pharmacy Medical Store and Sale Point v1.0, where the catID parameter in /medical/inventories.php is vulnerable to a Time-Based blind SQL injection. This weakness could allow an attacker to retrieve all databases from the backend. The vulnerability stems from imp...

kernel: SCSI target (LIO) write to any block on ILO backstore

A flaw was found in the Linux kernel’s implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to overwrite data on t...

Sourcecodester Medical Store Point SQL注入漏洞

Sourcecodester Medical Store Point is a Sourcecodester open source application. A Pharmacy/Medical Store Point of Sale POS system. Pharmacy Medical Store and Sale Point suffers from a SQL injection vulnerability that originates from a blind time-based SQL injection attack performed on the Medical...

openSUSE Security Update : curl (openSUSE-2021-808)

This update for curl fixes the following issues : - CVE-2021-22898: Fixed curl TELNET stack contents disclosure bsc1186114. - Allow partial chain verification jscSLE-17956 - Have intermediate certificates in the trust store be treated as trust-anchors, in the same way as self-signed root CA...

GSD-2021-1000024 dmaengine: idxd: fix wq size store permission state

dmaengine: idxd: fix wq size store permission state This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.11.16 by commit...

GSD-2021-1000040 update freeze attack in DroidScript version all versions

DroidScript, all versions, were removed from the Google store after allegations of malware and ad fraud surfaced from Google. It is reported that ad clicking activity did take place but that it was not as a direct result from DriodScript themselves. However due to the removal of DroidScript it is...

Security Bulletin: Multiple Security Vulnerabilities have been resolved in IBM Application Gateway (CVE-2021-20576, CVE-2021-20575, CVE-2021-29665)

Summary Multiple Security vulnerabilities have been fixed in the IBM Application Gateway product. Vulnerability Details CVEID: CVE-2021-20576 DESCRIPTION: IBM Application Gateway could allow a remote attacker to send a specially crafted HTTP GET request that could cause the application to crash...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2021:1762-1)

This update for curl fixes the following issues : CVE-2021-22898: Fixed curl TELNET stack contents disclosure bsc1186114. Allow partial chain verification jscSLE-17956 - Have intermediate certificates in the trust store be treated as trust-anchors, in the same way as self-signed root CA...

SUSE-SU-2021:1763-1 Security update for curl

This update for curl fixes the following issues: - CVE-2021-22898: Fixed curl TELNET stack contents disclosure bsc1186114. - Allow partial chain verification jscSLE-17956 Have intermediate certificates in the trust store be treated as trust-anchors, in the same way as self-signed root CA...

Oracle Linux 8 : libdb (ELSA-2021-1675)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1675 advisory. - Resolves: CVE-2019-2708 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not teste...