PT-2021-8081 · Linux +7 · Linux Kernel +7

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.19.223 Linux kernel versions prior to 5.4.169 Linux kernel versions prior to 5.10.89 Linux kernel versions prior to 5.15 Linux kernel versions prior to 5.15.12 Description: The issue is related to the i2c...

SUSE-SU-2021:4202-1 Security update for mariadb

This update for mariadb fixes the following issues: Update to 10.2.41: - CVE-2021-35604: Fixed InnoDB vulnerability that allowed an high privileged attacker with network access via multiple protocols to compromise MySQL bsc1192497...

Security update for log4j (important)

openSUSE Security Update: Security update for log4j Announcement ID: openSUSE-SU-2021:1601-1 Rating: important References: 1193743 Cross-References: CVE-2021-44228 CVE-2021-45046 CVSS scores: CVE-2021-44228 NVD : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 SUSE: 9.8...

PT-2021-6077

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 3.0.1 Description The issue is related to a double free error in certain out-of-memory conditions, as demonstrated by a failure of the mbedtls ssl set session function. This error can potentially allow a remote...

Security Bulletin: IBM MQ is vulnerable to multiple issues with libcurl (CVE-2021-22946, CVE-2021-22947)

Summary Multiple issues were identified with a version of libcurl which is shipped with IBM MQ. libcurl is used by IBM MQ to provide CCDTURL functionality. Vulnerability Details CVEID: CVE-2021-22946 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused b...

OPENSUSE-SU-2021:4109-1 Security update for logback

This update for logback fixes the following issues: Upgrade to version 1.2.8 + In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files. + Also in response to...

Apache Log4j End of Life (EOL) Detection - Windows

The Apache Log4j version on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

PT-2021-24198 · Mozilla +4 · Pdf.Js +4

Name of the Vulnerable Software and Affected Versions: GNOME Web aka Epiphany versions prior to 40.4 GNOME Web aka Epiphany versions 41.x prior to 41.1 Description: A security issue exists due to the use of a server's suggested filename as the pdf name value in PDF.js, leading to potential XSS...

PT-2021-24161 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.5 MediaWiki versions 1.36.x prior to 1.36.3 MediaWiki versions 1.37.x prior to 1.37.1 Description: An issue allows replacing the content of any arbitrary page using action=mcrundo followed by action=mcrrestore...

PT-2021-23163 · Bookstack · Bookstack

Name of the Vulnerable Software and Affected Versions: BookStack versions prior to 21.11.3 Description: The issue allows a logged-in user with no privileges or a guest user if public access is enabled to access the "/search/users/select" AJAX endpoint, which is meant for admins to manage audit...

PT-2021-23960 · Patrowl · Patrowl

Name of the Vulnerable Software and Affected Versions: PatrOwl versions prior to 1.77 Description: The issue is related to improper privilege management in PatrowlManager, allowing unlogged-in users to download all finding import files. The files are stored under /media/imports//, where owner id ...

PT-2021-5369

Name of the Vulnerable Software and Affected Versions Apache Log4j2 versions 2.15.0 Apache Log4j2 versions prior to 2.16.0 Java 8 Apache Log4j2 versions prior to 2.12.2 Java 7 Description The issue is related to the deserialization of untrusted data in the Apache Log4j2 library, which can be...

PT-2021-22771 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.0 through 14.3.6 GitLab CE/EE versions 14.4 through 14.4.4 GitLab CE/EE versions 14.5 through 14.5.2 Description: An issue has been discovered in GitLab CE/EE where the diff feature could be used to trigger high load...

OPENSUSE-SU-2021:1554-1 Security update for glib-networking

This update for glib-networking fixes the following issues: Update to version 2.62.4: - CVE-2020-13645: Fixed a connection failure when the server identity is unset bsc1172460. This update was imported from the SUSE:SLE-15-SP2:Update update project...

PT-2021-16364 · WordPress · Tawk.To Live Chat

Name of the Vulnerable Software and Affected Versions: Tawk.To Live Chat WordPress plugin versions prior to 0.6.0 Description: The issue concerns the lack of capability and CSRF checks in the tawkto setwidget and tawkto removewidget AJAX actions, which are available to any authenticated user. Thi...

PT-2021-7883 · Google +1 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 96.0.4664.93 Description: The issue is related to a use after free in the ANGLE library of Google Chrome, allowing a remote attacker to perform arbitrary read/write via a crafted HTML page. This can be exploite...

MGASA-2021-0531 Updated docker-containerd packages fix security vulnerability

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents...

SUSE-SU-2021:14850-1 Security update for clamav

This update for clamav fixes the following issues: - CVE-2018-14679: Fixed off-by-one issue in embedded libmspack that could lead to denial of service bsc1103032. - Update to 0.103.4 bsc1192346. - Add documentation about max file size purpose and side effect in the 'clamscan' and 'clamdscan'...

PT-2021-16324 · WordPress · Bulk Datetime Change

Name of the Vulnerable Software and Affected Versions: Bulk Datetime Change WordPress plugin versions prior to 1.12 Description: The issue allows users with Contributor roles to list private post titles of other users and change the posted date of other users' posts due to a lack of capability...

MGASA-2021-0522 Updated freerdp packages fix security vulnerability

All FreeRDP clients prior to version 2.4.1 using gateway connections '/gt:rpc' fail to validate input data. A malicious gateway might allow client memory to be written out of bounds. This issue has been resolved in version 2.4.1. If you are unable to update then use /gt:http rather than /gt:rdp...