Design/Logic Flaw

Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run...

PYSEC-2021-60

Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run...

Execution of untrusted code through config file

Impact It is possible to run arbitrary commands through the yaml.load method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. Workarounds Manually adjust yaml.load to yaml.safeload For mo...

GHSA-8278-88VV-X98R Execution of untrusted code through config file

Impact It is possible to run arbitrary commands through the yaml.load method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. Workarounds Manually adjust yaml.load to yaml.safeload For mo...

CVE-2021-21371 Execution of untrusted code through config file

Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run...

CVE-2021-21371

CVE-2021-21371 affects Tenable for Jira Cloud (tenable-jira-cloud) prior to version 1.1.21. The underlying issue is an insecure YAML handling: yaml.load() enables an attacker with local host access to execute arbitrary code via a crafted YAML configuration. Remediation: upgrade to version 1.1.21 ...

EulerOS Virtualization 2.9.1 : openssl (EulerOS-SA-2021-1619)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as...

SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0735-1)

The SUSE Linux Enterprise 15 SP2 kernel RT was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping XSA-365 bsc1181843. CVE-2021-26931: Fixed an issue where Linux kernel was treating...

EulerOS Virtualization 2.9.1 : trousers (EulerOS-SA-2021-1628)

According to the versions of the trousers package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the...

SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0743-1)

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping XSA-365 bsc1181843. CVE-2021-26931: Fixed an issue where Linux kernel was treating gra...

SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0742-1)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bug was fixed : CVE-2021-3348: Fixed a use-after-free read in nbdqueuerq bsc1181504. The update package also includes non-security fixes. See advisory for details. Note that Tenabl...

Alex Weber Tenable 代码问题漏洞

Alex Weber Tenable is an Alex Weber open source application. It is used to gain insight into the risk exposure of every asset on any platform. Tenable for Jira Cloud has a security vulnerability that allows an attacker with local access to the host to run arbitrary code by running the application...

RHEL 7 : .NET Core 2.1 on Red Hat Enterprise Linux (RHSA-2021:0787)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0787 advisory. .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2021:0713-1)

This update for freeradius-server fixes the following issues : move logrotate options into specific parts for each log as 'global' options will persist past and clobber global options in the main logrotate config bsc1180525 Note that Tenable Network Security has extracted the preceding descriptio...

Tenable SecurityCenter 5.16.x / 5.17.0 Multiple Vulnerabilities (TNS-2021-03)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is in the 5.16.0 - 5.17.0 version range. It is, therefore, affected by multiple vulnerabilities in a third-party component OpenSSL. Updated versions have been made available by the provider...

EulerOS Virtualization 3.0.6.6 : nss (EulerOS-SA-2021-1502)

According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multipl...

EulerOS Virtualization for ARM 64 3.0.6.0 : openssl (EulerOS-SA-2021-1549)

According to the version of the openssl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known...

EulerOS Virtualization 3.0.6.6 : mesa (EulerOS-SA-2021-1499)

According to the version of the mesa packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker...

CVE-2021-20076

Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to perform Remote Code Execution RCE on the Tenable.sc server via Hypertext Preprocessor unserialization...

CVE-2021-20076

Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to perform Remote Code Execution RCE on the Tenable.sc server via Hypertext Preprocessor unserialization...