Xxe

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity XXE attacks. When this developer utility is misused for purposes involving external or user submitted data in custom...

[SECURITY] Fedora 34 Update: transfig-3.2.8a-2.fc34

The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Install transfig...

F5 BIG-IQ Command Injection Vulnerability

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. BIG-IQ Centralized Management suffers from a command injection...

Vulnerability fixed in F5 BIG-IQ Centralized Management

F5 has fixed a vulnerability in BIG-IQ Centralized Management. An authenticated remote malicious party could potentially exploit the vulnerability potentially exploit it to execute arbitrary code under root privileges. The vulnerability is located in the BIG-IQ Configuration utility. Successful...

F5 BIG-IQ command injection vulnerability

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. BIG-IQ Centralized Management suffers from a command injection...

Important: Red Hat Security Advisory: glib2 security update

An update for glib2 is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact...

Important: glib2 security and bug fix update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: integer overflow in...

CVE-2021-33564

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features...

CVE-2021-33564

Summary: CVE-2021-33564 affects the Dragonfly Ruby Gem prior to 1.4.0. An argument injection flaw allows remote attackers to read and write arbitrary files via a crafted URL when the verify_url option is disabled, potentially enabling arbitrary code execution. The root cause is described as misha...

CVE-2021-3549

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avrelf32loadrecordsfromsection probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as...

dragonfly -- argument injection

NVD reports: An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process...

CVE-2021-3561

An Out of Bounds flaw was found in fig2dev utility within transfig. An attacker could use this flaw and provide a crafted input to readobjects probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availabilit...

CVE-2017-17678

BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting XSS. A DOM-based cross-site scripting vulnerability was discovered in a legacy utility...

CVE-2017-17678

BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting XSS. A DOM-based cross-site scripting vulnerability was discovered in a legacy utility...

[SECURITY] Fedora 32 Update: exif-0.6.22-1.fc32

Small command-line utility to show EXIF information hidden in JPEG files...

PT-2021-8570

Name of the Vulnerable Software and Affected Versions BMC Remedy Mid Tier version 9.1SP3 Description A DOM-based cross-site scripting issue was found in a legacy utility of the software, which can be exploited for cross-site scripting XSS attacks. Recommendations For version 9.1SP3, consider...

CVE-2017-17678: Improper Neutralization of Input During Web Page Generation

BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting XSS. A DOM-based cross-site scripting vulnerability was discovered in a legacy utility...

Low: Red Hat Security Advisory: sudo security and bug fix update

An update for sudo is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Moderate: Red Hat Security Advisory: cpio security update

An update for cpio is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

RLSA-2021:1610 Moderate: curl security and bug fix update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: FTP PASV command response can cause curl to connect to arbitrary host CVE-2020-8284 curl: Malicious FTP server can...