SUSE SLED15 / SLES15 Security Update : cifs-utils (SUSE-SU-2021:1161-1)

This update for cifs-utils fixes the following issues : CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container bsc1183239 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

CVE-2021-23277

Eaton Intelligent Power Manager IPM prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can...

chhyun-utils (>=1.0.12 <=1.0.39), jotunheimr (>=1.11.0 <=1.12.1) +4 more potentially affected by CVE-2019-10788 via im-metadata (>=2.1.1 <=3.0.1)

im-metadata NPM version =2.1.1, =1.0.12, =1.11.0, =1.0.0, =0.0.1, =2.0.2, =2.0.3 - wn-s3-uploader =1.0.0 Source cves: CVE-2019-10788 Source advisory: OSV:GHSA-QFXV-QQVG-24PG...

SUSE-SU-2021:1161-1 Security update for cifs-utils

This update for cifs-utils fixes the following issues: - CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container bsc1183239...

SUSE-SU-2021:1159-1 Security update for cifs-utils

This update for cifs-utils fixes the following issues: - CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container bsc1183239...

PT-2021-2689

Name of the Vulnerable Software and Affected Versions Apache Commons IO versions prior to 2.7 Description The issue is related to the FileNameUtils.normalize method in Apache Commons IO, which incorrectly handles directory traversal sequences such as "//../foo" or "..foo". This could allow a remo...

Cross-site Scripting (XSS)

mediawiki is vulnerable to cross-site scripting XSS. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a tag, bypassing sanitization steps, and potentially allowing for XSS...

OESA-2021-1131 wavpack security update

WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. For version 5.0.0, several new file formats and lossless DSD audio compression were added, making WavPack a universal audio archiving solution. Security Fixes: WavPa...

cron-utils: template injection allows attackers to inject arbitrary Java EL expressions leading to remote code execution

A flaw was found in cron-utils. End applications passing unsanitized user input which is subsequently parsed by the @Cron annotation can allow an attacker to execute arbitrary expressions using JavaEL which will be implicitly executed by the constraint validator. The highest threat from this...

EulerOS 2.0 SP5 : iscsi-initiator-utils (EulerOS-SA-2021-1683)

According to the versions of the iscsi-initiator-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when...

Huawei EulerOS: Security Advisory for iscsi-initiator-utils (EulerOS-SA-2021-1683)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : freeradius-server (openSUSE-2021-428)

This update for freeradius-server fixes the following issues : - move logrotate options into specific parts for each log as 'global' options will persist past and clobber global options in the main logrotate config bsc1180525 This update was imported from the SUSE:SLE-15-SP2:Update update project...

Security update for crmsh (important)

openSUSE Security Update: Security update for crmsh Announcement ID: openSUSE-SU-2021:0410-1 Rating: important References: 1154927 1178454 1178869 1179999 1180126 1180137 1180571 1180688 1181415 Cross-References: CVE-2020-35459 CVE-2021-3020 CVSS scores: CVE-2020-35459 NVD : 7.8...

Huawei EulerOS: Security Advisory for cifs-utils (EulerOS-SA-2021-1664)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for cifs-utils (EulerOS-SA-2021-1592)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

-tompan-reacttemplate (>=1.0.1 <=1.1.0), 0x0.icu.anima (=0.1.0) +5681 more potentially affected by CVE-2021-24033 via react-dev-utils (>=0.4.0 <=11.0.3)

react-dev-utils NPM version =0.4.0, =1.0.1, =0.1.0, =0.1.2, =1.0.3, =0.1.0, =0.1.21, =1.0.0, =0.1.0, =2.0.5, =2.2.0 and more Source cves: CVE-2021-24033 Source advisory: OSV:GHSA-5Q6M-3H65-W53X...

GHSA-5Q6M-3H65-W53X react-dev-utils OS Command Injection in function `getProcessForPort`

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...

react-dev-utils OS Command Injection in function `getProcessForPort`

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...

EulerOS Virtualization 2.9.0 : cifs-utils (EulerOS-SA-2021-1664)

According to the version of the cifs-utils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject...

OS Command Injection

react-dev-utils is vulnerable to OS command injection. An attacker is able to inject and execute arbitrary OS commands on the host OS due to the usage of childprocess.execFileSync in the function getProcessIdOnPort...