RHEL 7 : qemu-kvm-rhev (RHSA-2021:0934)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0934 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provi...

RHEL 7 : rubygem-em-http-request (RHSA-2021:0937)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:0937 advisory. EventMachine based, async HTTP Request client. Security Fixes: missing SSL hostname validation allows MITM CVE-2020-13482 For more details about the...

RHEL 7 : kernel (RHSA-2021:0878)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0878 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: locking issue in...

RHEL 7 : perl (RHSA-2021:0883)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0883 advisory. Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes: per...

SUSE SLES12 Security Update : glib2 (SUSE-SU-2021:0801-1)

This update for glib2 fixes the following issues : CVE-2021-27218: gbytearraynewtake takes a gsize as length but stores in a guint, this patch will refuse if the length is larger than guint. bsc1182328 CVE-2021-27219: gmemdup takes a guint as parameter and sometimes leads into an integer overflow...

Debian DLA-2596-1 : shadow security update

Several vulnerabilities were discovered in the shadow suite of login tools. An attacker may escalate privileges in specific configurations. CVE-2017-20002 Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even...

RHEL 7 : openvswitch2.13 (RHSA-2021:0835)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0835 advisory. Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic...

RHEL 7 : openvswitch2.11 (RHSA-2021:0834)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0834 advisory. Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic...

SUSE SLED15 / SLES15 Security Update : glib2 (SUSE-SU-2021:0778-1)

This update for glib2 fixes the following issues : CVE-2021-27218: gbytearraynewtake takes a gsize as length but stores in a guint, this patch will refuse if the length is larger than guint. bsc1182328 CVE-2021-27219: gmemdup takes a guint as parameter and sometimes leads into an integer overflow...

Nessus Network Monitor < 5.13.0 Multiple Vulnerabilities (TNS-2021-02)

The version of Nessus Network Monitor NNM installed on the remote host is prior to 5.13.0. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid147729; scriptversion"1.8";...

Arbitrary Code Execution

tenable-jira-cloud is vulnerable to arbitrary code execution. An attacker with local access to the host is able to run arbitrary commands through the yaml.load method by running the application with a malicious YAML file...

EulerOS Virtualization 2.9.0 : net-snmp (EulerOS-SA-2021-1660)

According to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Net-SNMP through 5.7.3 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to ru...

CVE-2021-21371

Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run...

CVE-2021-21371

Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run...

PYSEC-2021-60

Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run...

Design/Logic Flaw

Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run...

PYSEC-2021-60

Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run...

Execution of untrusted code through config file

Impact It is possible to run arbitrary commands through the yaml.load method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. Workarounds Manually adjust yaml.load to yaml.safeload For mo...

GHSA-8278-88VV-X98R Execution of untrusted code through config file

Impact It is possible to run arbitrary commands through the yaml.load method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. Workarounds Manually adjust yaml.load to yaml.safeload For mo...

CVE-2021-21371

CVE-2021-21371 affects Tenable for Jira Cloud (tenable-jira-cloud) prior to version 1.1.21. The underlying issue is an insecure YAML handling: yaml.load() enables an attacker with local host access to execute arbitrary code via a crafted YAML configuration. Remediation: upgrade to version 1.1.21 ...