PT-2021-7883 · Google +1 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 96.0.4664.93 Description: The issue is related to a use after free in the ANGLE library of Google Chrome, allowing a remote attacker to perform arbitrary read/write via a crafted HTML page. This can be exploite...

PT-2021-16364 · WordPress · Tawk.To Live Chat

Name of the Vulnerable Software and Affected Versions: Tawk.To Live Chat WordPress plugin versions prior to 0.6.0 Description: The issue concerns the lack of capability and CSRF checks in the tawkto setwidget and tawkto removewidget AJAX actions, which are available to any authenticated user. Thi...

MGASA-2021-0531 Updated docker-containerd packages fix security vulnerability

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents...

SUSE-SU-2021:14850-1 Security update for clamav

This update for clamav fixes the following issues: - CVE-2018-14679: Fixed off-by-one issue in embedded libmspack that could lead to denial of service bsc1103032. - Update to 0.103.4 bsc1192346. - Add documentation about max file size purpose and side effect in the 'clamscan' and 'clamdscan'...

PT-2021-16324 · WordPress · Bulk Datetime Change

Name of the Vulnerable Software and Affected Versions: Bulk Datetime Change WordPress plugin versions prior to 1.12 Description: The issue allows users with Contributor roles to list private post titles of other users and change the posted date of other users' posts due to a lack of capability...

MGASA-2021-0522 Updated freerdp packages fix security vulnerability

All FreeRDP clients prior to version 2.4.1 using gateway connections '/gt:rpc' fail to validate input data. A malicious gateway might allow client memory to be written out of bounds. This issue has been resolved in version 2.4.1. If you are unable to update then use /gt:http rather than /gt:rdp...

PT-2021-16358 · WordPress · Reviews Plus

Name of the Vulnerable Software and Affected Versions: Reviews Plus WordPress plugin versions prior to 1.2.14 Description: The issue allows submission of a long integer as a rating, causing a Denial of Service in the review section when an authenticated user submits such a rating and the reviews...

PT-2021-21402 · WordPress · Wp Reset Pro Premium

Name of the Vulnerable Software and Affected Versions: WP Reset PRO Premium plugin versions = 5.98 Description: The issue allows any authenticated user to reset the entire database, regardless of their authorization, leading to a complete website reset and potential takeover. Recommendations: For...

Medium: docker

Issue Overview: Docker Engine before 18.09 allows attackers to cause a denial of service dockerd memory consumption via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemonunix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. CVE-2018-20699 A command injectio...

PT-2021-6678 · Oracle +1 · Mysql Cluster +1

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 7.4.34 and prior MySQL Cluster versions 7.5.24 and prior MySQL Cluster versions 7.6.20 and prior MySQL Cluster versions 8.0.27 and prior Description: The issue is related to a stack-based buffer overflow in the MySQL...

JetBrains Hub Information Disclosure Vulnerability

JetBrains Hub is a server that can handle authentication, authorization, users, groups, permissions, and projects across multiple JetBrains Team Tools installations. An information disclosure vulnerability exists in JetBrains Hub versions prior to 2021.1.13690. An attacker could exploit this...

PT-2021-23758 · Nlnet +1 · Routinator +1

Name of the Vulnerable Software and Affected Versions: NLnet Labs Routinator versions prior to 0.10.2 Description: A validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall...

PT-2021-23746 · Unknown · Fort Validator

Name of the Vulnerable Software and Affected Versions: FORT Validator versions prior to 1.5.2 Description: The issue occurs when an RPKI CA publishes an X.509 EE certificate, causing FORT Validator to crash. This crash leads to RTR clients, such as BGP routers, losing access to the RPKI VRP data...

PT-2021-7326 · Mariadb +6 · Mariadb +7

Name of the Vulnerable Software and Affected Versions: MariaDB versions prior to 10.6.5 Description: The issue is related to an integer overflow in the sql lex.cc component of MariaDB, which can lead to an application crash. This can be exploited by an attacker to cause a denial of service...

PT-2021-6444 · Mbed Tls +3 · Mbed Tls +3

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 3.0.0 and earlier Description: A Denial of Service issue exists in the mbedtls pkcs12 derivation function when an input password's length is 0. This can be exploited by a remote attacker to cause a denial of service. The...

PT-2021-23831 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.30 Description: An issue was discovered in the log viewer.php Log View page, which allows an authenticated user to choose an arbitrary filename for download, not limited to the intended directory or the...

[SECURITY] [DSA 4999-1] asterisk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4999-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 01, 2021 https://www.debian.org/security/faq -...

OPENSUSE-SU-2021:1433-1 Security update for opera

This update for opera fixes the following issues: Opera was updated to version 80.0.4170.63 - CHR-8612 Update chromium on desktop-stable-94-4170 to 94.0.4606.81 - DNA-95434 Crash at opera::ThemesService::UpdateCurrentTheme - The update to chromium 94.0.4606.81 fixes following issues:...

CVE-2021-41973

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater...

OPENSUSE-SU-2021:1419-1 Security update for squid

This update for squid fixes the following issues: Update to version 4.17: - CVE-2021-28116: Fixed a out-of-bounds read in the WCCP protocol bsc1189403. This update was imported from the SUSE:SLE-15:Update update project...