SUSE-SU-2021:2798-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: - Update to version jdk8u302 icedtea 3.20.0 - CVE-2021-2341: Improve file transfers. bsc1188564 - CVE-2021-2369: Better jar file validation. bsc1188565 - CVE-2021-2388: Enhance compiler validation. bsc1188566 - CVE-2021-2161: Less...

SUSE-SU-2021:2614-1 Security update for spice-vdagent

This update for spice-vdagent fixes the following issues: - Update to version 0.21.0 - CVE-2020-25650: memory DoS via arbitrary entries in activexfers hash table bsc1177780 - CVE-2020-25651: possible file transfer DoS and information leak via activexfers hash map bsc1177781 - CVE-2020-25652:...

thunderbird security update

78.12.0-3.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 78.12.0-3 - Rebuild to pickup older nss 78.12.0-2 - Update to 78.12.0 build2 78.12.0-1 - Update to 78.12.0 build1...

OPENSUSE-SU-2021:1785-1 Security update for postgresql13

This update for postgresql13 fixes the following issues: - Upgrade to version 13.3: - CVE-2021-32027: Fixed integer overflows in array subscripting calculations bsc1185924. - CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists bsc1185925. -...

OPENSUSE-SU-2021:2320-1 Security update for sqlite3

This update for sqlite3 fixes the following issues: - Update to version 3.36.0 - CVE-2020-15358: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener optimization bsc1173641 - CVE-2020-9327: NULL pointer dereference and segmentation fault because of generated...

PT-2021-14634 · Dell · Dell Emc Unity +2

Name of the Vulnerable Software and Affected Versions: Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 Description: The issue concerns a plain-text password storage vulnerability. A local malicious user with high privileges may exploit this to gain access with the privilege...

OPENSUSE-SU-2021:2274-1 Security update for kubevirt

This update for kubevirt fixes the following issues: General: - Updated kubevirt to version 0.40.0 - Fixed an issue when calling virsh-domcapabilities - Fixed the the wrong registry path for containers. Security fixes: - CVE-2021-20286: A flaw was found in libnbd 1.7.3. An assertion failure in...

Vulnerability fixed in Cacti

Vulnerabilities have been fixed in Cacti. A malicious person at remote can exploit the vulnerabilities to perform a Cross-Site Scripting XSS attack. Such an attack can lead to the execution of arbitrary script code in the browser used to visit the application is visited. Not every vulnerability h...

WordPress Jannah premium theme <= 5.4.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Truoc Phan in WordPress Jannah premium theme versions = 5.4.4. Solution Update the WordPress Jannah premium theme to the latest available version at least 5.4.5...

PT-2021-9735 · Openvpn · Openvpn Access Server

Name of the Vulnerable Software and Affected Versions: OpenVPN Access Server versions 2.8.7 and earlier Description: The issue allows remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication. This can potentially be used to trigg...

PT-2021-3338 · 3S Smart Software Solutions · Codesys V2 Web-Server

Name of the Vulnerable Software and Affected Versions: CODESYS V2 Web-Server versions prior to 1.1.9.20 Description: The issue is related to improper access control in the CODESYS V2 Web-Server, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability...

PT-2021-4573 · Exiv2 +10 · Exiv2 +10

Name of the Vulnerable Software and Affected Versions: Exiv2 versions v0.27.3 and earlier Description: An out-of-bounds read was found in Exiv2, triggered when it is used to write metadata into a crafted image file. This could potentially allow an attacker to cause a denial of service by crashing...

PT-2021-16923 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.25 Description: An issue was discovered that allows XSS attacks due to inadequate escaping. This is possible using the logo parameter of the default templates on the error page. Recommendations: For Joomla!...

PT-2021-14481 · Syncthing +2 · Syncthing +2

Name of the Vulnerable Software and Affected Versions: Syncthing versions prior to 1.15.0 Description: The issue allows a malicious relay server to cause Syncthing to crash by sending a malformed relay protocol message with a negative length field. Similarly, the relay server strelaysrv can be...

WordPress Advanced Custom Fields PRO plugin <= 5.9.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Juan David Ordoñez Noriega in WordPress Advanced Custom Fields PRO plugin versions = 5.9.0. Solution Update the WordPress Advanced Custom Fields PRO plugin to the latest available version at least 5.9.1...

SUSE-SU-2021:0942-1 Security update for hawk2

This update for hawk2 fixes the following issues: - Update to version 2.6.3: Remove hawkinvoke and use capture3 instead of runas bsc1179999CVE-2020-35459 Remove unnecessary chmod bsc1182166CVE-2021-25314 Sanitize filename to contains whitelist of alphanumeric bsc1182165...

SUSE-SU-2021:0263-1 Security update for terraform

This update for terraform fixes the following issues: - Updated terraform to version 0.13.4 bsc1177421 Many features, bug fixes, and enhancements were made during this update. Please refer to the terraform rpm changelog, for a full list of all changes. - The following terraform providers were...

OPENSUSE-SU-2021:0145-1 Security update for viewvc

This update for viewvc fixes the following issues: - update to 1.1.28 boo1167974, CVE-2020-5283: security fix: escape subdir lastmod file name 211 fix standalone.py first request failure 195 suppress stack traces with option to show 140 distinguish text/binary/image files by icons 166, 175 colori...

PT-2021-14356

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3 Description: OneDev is an all-in-one devops platform. The REST UserResource endpoint performs a security check to ensure only administrators can list user details. However, the /users/id endpoint lacks security...

PT-2021-1885 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier Description: The issue is related to an insecure direct object vulnerability IDOR in the checkout module. Successful exploitation coul...