CVE-2021-21412 [thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values

Potential for arbitrary code execution in npm package @thi.ng/egf gpg-tagged property values only if decrypt: true option is enabled. PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values since GPG only availab...

Cross-site Scripting (XSS) - Generic in forkcms/library

✍️ Description Please enter a description of the vulnerability. Submitted values weren't escaped in case of date, time or hidden fields. This made it possible to perform an XSS attack by URL tampering 🕵️‍♂️ Proof of Concept Find a Spoon Form where there is a date, time or hidden field and pass...

CVE-2021-28099: Use of Insufficiently Random Values

In Netflix OSS Hollow, since the Files.existsparent is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated...

CVE-2021-22309: Use of Insufficiently Random Values

There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Attackers can exploit this vulnerability by brute forcing to obtain sensitive message. This can lead to information leak. Affected product versions include:USG9500 versions...

The vulnerability of the WEBrick library for the Ruby programming language lies in its improper validation of header values, which allows attackers to compromise data integrity.

The vulnerability of the WEBrick library for the Ruby programming language is related to improper validation of header values. Exploiting this vulnerability can allow an attacker to compromise the integrity of data...

CVE-2021-24144

Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files...

PT-2021-15691 · Unknown · Modern Events Calendar Lite

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite versions prior to 5.16.5 Description: The issue allows for arbitrary file upload due to improper checking of imported files. An administrator can upload PHP files by using the 'text/csv' content-type in the request...

Denial Of Service (DoS)

qemu is vulnerable to denial of service. An infinite loop in the e1000 NIC emulator occurs while processing transmit tx descriptors in processtxdesc when various descriptor fields are initialized with invalid values...

CVE-2020-11188

Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

CVE-2020-11189: Out-of-bounds Read

Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

Cisco SD-WAN vManage Software SQL Injection Vulnerability (cisco-sa-vmanage-v78FubGV)

The version of Cisco SD-WAN vManage Software installed on the remote host is affected by a vulnerability as referenced in the cisco-sa-vmanage-v78FubGV advisory. - A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker ...

OPENSUSE-SU-2021:0408-1 Security update for openldap2

This update for openldap2 fixes the following issues: - bsc1182408 CVE-2020-36230 - an assertion failure in slapd in the X.509 DN parsing in decode.c bernextelement, resulting in denial of service. - bsc1182411 CVE-2020-36229 - ldapX509dn2bv crash in the X.509 DN parsing in adkeystring, resulting...

Denial of Service (DoS)

Overview mongo-express is a web-based MongoDB admin interface written with Node.js, Express and Bootstrap3 Affected versions of this package are vulnerable to Denial of Service DoS when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash. Details Denial of...

Updated ansible packages fix security vulnerability

User data leak in snmpfacts module CVE-2021-20178. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been patched to fix these issues...

MGASA-2021-0132 Updated ansible packages fix security vulnerability

User data leak in snmpfacts module CVE-2021-20178. The bitbucketpipelinevariable module exposed secured values CVE-2021-20180. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been updated to version 2.9.18...

MGASA-2021-0131 Updated ansible packages fix security vulnerability

User data leak in snmpfacts module CVE-2021-20178. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been patched to fix these issues...

MGASA-2021-0121 Updated postgresql packages fix security vulnerabilities

A user having an UPDATE privilege on a partitioned table but lacking the SELECT privilege on some column may be able to acquire denied-column values from an error message CVE-2021-3393. A user having a SELECT privilege on an individual column can craft a special query that returns all columns of...

CVE-2021-0375: Use of Insufficiently Random Values

In onPackageModified of VoiceInteractionManagerService.java, there is a possible change of default applications due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

SUSE SLED15 / SLES15 Security Update : openldap2 (SUSE-SU-2021:0723-1)

This update for openldap2 fixes the following issues : bsc1182408 CVE-2020-36230 - an assertion failure in slapd in the X.509 DN parsing in decode.c bernextelement, resulting in denial of service. bsc1182411 CVE-2020-36229 - ldapX509dn2bv crash in the X.509 DN parsing in adkeystring, resulting in...

NewStart CGSL MAIN 6.02 : python3 Multiple Vulnerabilities (NS-SA-2021-0059)

The remote NewStart CGSL host, running version MAIN 6.02, has python3 packages installed that are affected by multiple vulnerabilities: - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to...