PT-2021-20904 · Espocrm · Espocrm

Name of the Vulnerable Software and Affected Versions: EspoCRM versions 6.1.6 and prior Description: The issue is a persistent type II cross-site scripting XSS vulnerability in processing user-supplied avatar images. This vulnerability was fixed in version 6.1.7 of the product. Recommendations: F...

SUSE-SU-2021:2555-1 Security update for git

This update for git fixes the following issues: Update from version 2.26.2 to version 2.31.1 jscSLE-18152 Security fixes: - CVE-2021-21300: On case-insensitive file systems with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters such as Git LFS,...

PT-2021-18615 · Unknown · Vscode-Phpmd

Name of the Vulnerable Software and Affected Versions: vscode-phpmd extension version 1.3.0 and earlier Description: The issue allows remote attackers to execute arbitrary code via a crafted phpmd.command value in a workspace folder. Recommendations: For versions prior to 1.3.0, update to version...

MGASA-2021-0374 Updated netty packages fix security vulnerabilities

In Netty io.netty:netty-codec-http2 before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by Http2MultiplexHandler as it is propagated up. This is fine as long as the...

SUSE-SU-2021:1863-2 Security update for umoci

This update for umoci fixes the following issues: Update to v0.4.7 bsc1184147. - CVE-2021-29136: Fixed overwriting of host files via malicious layer bsc1184147...

PT-2021-6460 · Otrs Ag +1 · Otrs +2

Name of the Vulnerable Software and Affected Versions: OTRS AG OTRS Community Edition versions 6.0.1 and later OTRS AG OTRS versions prior to 7.0.27 Description: The issue is related to errors in permission handling in the OTRS ticket system, allowing an attacker to remotely access confidential...

PT-2021-6700

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.11.1 Description The issue is related to the SSL socket in PJSIP, a free and open source multimedia communication library. It involves a race condition between callback and destroy due to the accepted socket having no...

MGASA-2021-0350 Updated ffmpeg packages fix security vulnerabilities

This update provides ffmpeg version 4.3.2, which fixes several security vulnerabilities and other bugs which were corrected upstream...

PT-2021-19894 · Nextcloud +2 · Nextcloud Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 19.0.13 Nextcloud Server versions prior to 20.0.11 Nextcloud Server versions prior to 21.0.3 Description: The Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to...

PT-2021-19887 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 19.0.13 Nextcloud Server versions prior to 20.0.11 Nextcloud Server versions prior to 21.0.3 Description: The issue concerns the handling of webauthn tokens in Nextcloud Server. In affected versions, webauth...

OPENSUSE-SU-2021:1989-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: - Update to version jdk8u292 icedtea 3.19.0. - CVE-2021-2161: Fixed incomplete enforcement of JAR signing disabled algorithms bsc1185055...

SUSE-SU-2021:2085-1 Security update for go1.16

This update for go1.16 fixes the following issues: - Updated go to upstream version 1.16.4 released 2021-05-06 bsc1182345. - CVE-2021-31525: Fixed stack overflow via net/http ReadRequest bsc1185790...

SUSE-SU-2021:2082-1 Security update for go1.15

This update for go1.15 fixes the following issues: - Updated go to upstream version 1.15.12 released 2021-05-06 bsc1175132. - CVE-2021-31525: Fixed stack overflow via net/http ReadRequest bsc1185790...

SUSE-SU-2021:1989-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: - Update to version jdk8u292 icedtea 3.19.0. - CVE-2021-2161: Fixed incomplete enforcement of JAR signing disabled algorithms bsc1185055...

PT-2021-19862

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.16.1 Description The Nextcloud Android app is vulnerable to an issue where a malicious app on the same device could access the shared preferences of the Nextcloud Android application. This requires...

MGASA-2021-0264 Updated libgd packages fix a security vulnerability

A potential integer overflow is fixed in version 2.3.1...

OPENSUSE-SU-2021:0878-1 Security update for containerd, docker, runc

This update for containerd, docker, runc fixes the following issues: Docker was updated to 20.10.6-ce bsc1184768, bsc1182947, bsc1181594 Switch version to use -ce suffix rather than ce to avoid confusing other tools bsc1182476. CVE-2021-21284: Fixed a potential privilege escalation when the root...

PT-2021-14711 · Jenkins · Jenkins Scriptler Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Scriptler Plugin versions 3.1 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability because the script content is not escaped. This vulnerability is exploitable by attackers with...

Security update for 389-ds (moderate)

openSUSE Security Update: Security update for 389-ds Announcement ID: openSUSE-SU-2021:0868-1 Rating: moderate References: 1185356 Cross-References: CVE-2021-3514 CVSS scores: CVE-2021-3514 NVD : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 An update that...

PT-2021-15260

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 1.9.5 Description The issue is related to improper access control due to a missing permission check. This allows other authenticated users to create mail aliases for other users. Recommendations For versions...