netty: Information disclosure via the local system temporary directory

In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the...

netty: Information disclosure via the local system temporary directory

In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the...

The vulnerability of the Cisco AnyConnect Secure Mobility Client’s encryption protection removal process allows a perpetrator to execute arbitrary code with SYSTEM privileges.

The vulnerability of the Cisco AnyConnect Secure Mobility Client’s encryption protection removal process for Windows involves the creation of temporary files with insecure permissions. Exploiting this vulnerability allows a hacker to execute arbitrary code with SYSTEM privileges...

The vulnerability in the update process of the Cisco AnyConnect Secure Mobility Client cryptographic security tool for Windows allows a perpetrator to execute arbitrary code with SYSTEM privileges.

The vulnerability of the Cisco AnyConnect Secure Mobility Client cryptographic security update process for Windows relates to the creation of temporary files with insecure permissions. Exploiting this vulnerability can allow a attacker to execute arbitrary code with SYSTEM privileges...

The vulnerability of the Cisco AnyConnect Secure Mobility Client’s encryption protection removal process allows a perpetrator to execute arbitrary code with SYSTEM privileges.

The vulnerability of the Cisco AnyConnect Secure Mobility Client’s encryption protection removal process for Windows involves the creation of temporary files with insecure permissions. Exploiting this vulnerability allows a hacker to execute arbitrary code with SYSTEM privileges...

The vulnerability in the process of installing the Cisco AnyConnect Secure Mobility Client encryption software for Windows allows a perpetrator to execute arbitrary code with SYSTEM privileges.

The vulnerability of the Cisco AnyConnect Secure Mobility Client’s encryption protection setup for Windows relates to the creation of temporary files with insecure permissions. Exploiting this vulnerability can allow a hacker to execute arbitrary code with SYSTEM privileges...

The vulnerability of the Adobe Digital Editions e-book reading program lies in the creation of temporary files with insecure permissions, which allows a hacker to elevate their privileges and perform arbitrary writes to the file system.

The vulnerability of the Adobe Digital Editions e-book reading program lies in the creation of temporary files with insecure permissions. Exploiting this vulnerability can allow a remote attacker to enhance their privileges and perform arbitrary writes to the file system...

PT-2021-8567

Name of the Vulnerable Software and Affected Versions BMC Remedy Mid Tier version 9.1SP3 Description The system is affected by remote and local file inclusion due to a lack of restrictions on targeted files. This can lead to attacks such as system fingerprinting, internal port scanning, Server Si...

PT-2021-8570

Name of the Vulnerable Software and Affected Versions BMC Remedy Mid Tier version 9.1SP3 Description A DOM-based cross-site scripting issue was found in a legacy utility of the software, which can be exploited for cross-site scripting XSS attacks. Recommendations For version 9.1SP3, consider...

[ASA-202105-6] keycloak: multiple issues

Arch Linux Security Advisory ASA-202105-6 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2020-14302 CVE-2020-27838 CVE-2021-3513 CVE-2021-20202 CVE-2021-20222 Package : keycloak Type : multiple issues Remote : Yes Link :...

PT-2021-18038

Name of the Vulnerable Software and Affected Versions: Liferay Portal version 7.3.4 Description: A cross-site scripting XSS issue exists in the Asset module's categories administration page, allowing remote attackers to inject arbitrary web script or HTML via the site name variable. This could...

OESA-2021-1181 jersey security update

Jersey is the open source JAX-RS JSR 311 production quality Reference Implementation for building RESTful Web services. Security Fixes: Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the...

Debian: Security Advisory (DLA-2661-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Eclipse Jetty Vulnerability Affects IBM Control Center (CVE-2020-27216)

Summary Eclipse Jetty could allow a local authenticated attacker to gain elevated privileges on the system. Vulnerability Details CVEID: CVE-2020-27216 DESCRIPTION: Eclipse Jetty could allow a local authenticated attacker to gain elevated privileges on the system, caused by a race condition in th...

[SECURITY] [DLA 2661-1] jetty9 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2661-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler May 14, 2021 https://wiki.debian.org/LTS -...

PT-2021-18268 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4 Description: A malicious user could trigger a division by 0 in the Conv3D implementation. The implementatio...

PT-2021-18278 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: An attacker can trigger a division by 0 in...

PT-2021-18365 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4 Description: The implementation of tf.io.decode raw produces incorrect results and crashes the Python...

PT-2021-18332 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: Due to lack of validation in tf.raw...

PT-2021-3535 · WordPress · Kaswara Modern Vc Addons

Name of the Vulnerable Software and Affected Versions: Kaswara Modern VC Addons versions through 3.0.1 Description: The issue is related to unlimited file upload of dangerous types. Exploitation can allow a remote attacker to upload and execute arbitrary files. The vulnerability allows...