PT-2021-22548 · WordPress · Optinmonster

Name of the Vulnerable Software and Affected Versions: OptinMonster WordPress plugin versions up to, and including, 2.6.4 Description: The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation...

UVI-2021-1001841 powerpc/idle: Don't corrupt back chain when going idle

powerpc/idle: Don't corrupt back chain when going idle This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.76 by commit...

SUSE-SU-2021:14833-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: salt: - Exclude the full path of a download URL to prevent injection of malicious code bsc1190265 CVE-2021-21996 spacecmd: - Version 4.2.13-1 Update translation strings configchannelupdatefile handles directory properly bsc1190512 Add schedulearchivecomplet...

Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-22005 VMware vCenter Server arbitrary file upload...

OPENSUSE-SU-2021:3292-1 Security update for go1.16

This update for go1.16 fixes the following issues: - Update to go 1.16.8 - CVE-2021-39293: Fixed a buffer overflow issue in preallocation check that can cause OOM panic. bas...

PT-2021-14925 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.8 through 14.0.9 GitLab versions 14.1 through 14.1.4 GitLab versions 14.2 through 14.2.2 Description: An issue has been discovered in GitLab where, under specialized conditions, an invited group member may continue to have...

CVE-2021-41103

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory...

PT-2021-7752 · Redis +5 · Redis +5

Name of the Vulnerable Software and Affected Versions: Redis versions 3.2 through 6.2.5 Redis versions 3.2 through 6.0.15 Redis versions 3.2 through 5.0.13 can be simplified to: Redis versions 3.2 through 6.2.5 Description: The issue affects Redis, an open source, in-memory database that persists...

PT-2021-23413

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.36.2 Description The issue allows for a denial of service due to resource consumption caused by lengthy query processing time. Visiting Special:Contributions can sometimes result in a long running SQL query becaus...

MGASA-2021-0447 Updated webkit2 packages fix security vulnerability

Updated webkit2 packages fix security vulnerabilities: The webkit2 package has been updated to version 2.32.4, fixing various bugs and the following security issue: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30858...

Deserialization of untrusted data

parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding...

WordPress core <= 5.8 - Command injection vulnerability in the Lodash library

Command injection vulnerability in the Lodash library in WordPress core versions = 5.8. Version update list: 5.8 updated to 5.8.1, 5.7.2 updated to 5.7.3, 5.7.1 updated to 5.7.3, 5.7 updated to 5.7.3, 5.6.4 updated to 5.6.5, 5.6.3 updated to 5.6.5, 5.6.2 updated to 5.6.5, 5.6.1 updated to 5.6.5,...

Design/Logic Flaw

remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitra...

PT-2021-7212 · Mariadb +6 · Mariadb Server +6

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions prior to 10.7 Description: The issue is related to a denial of service vulnerability. In the file extra/mariabackup/ds compress.cc, when an error occurs while executing the create worker threads method, the held lock...

PT-2021-7211 · Mariadb +6 · Mariadb Server +6

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions prior to 10.7 Description: The issue is related to a denial of service vulnerability. In the extra/mariabackup/ds compress.cc file, when an error occurs while executing the create worker threads method, the held lock i...

PT-2021-22897 · Gnu +2 · Gnu Inetutils +2

Name of the Vulnerable Software and Affected Versions: GNU Inetutils versions prior to 2.2 Description: The issue concerns the ftp client in GNU Inetutils, which fails to validate addresses returned by PASV/LSPV responses, ensuring they match the server address. Recommendations: For GNU Inetutils...

OPENSUSE-SU-2021:1211-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - Update to version 1.4.3.24 - CVE-2021-3652: Fixed crypt handling of locked accounts. bsc1188455 This update was imported from the SUSE:SLE-15-SP2:Update update project...

CVE-2021-31005

Description: A logic issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15, macOS Monterey 12.0.1. Turning off "Block all remote content" may not apply to all remote content types...

PT-2021-4043

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.1 through 1.1.1k OpenSSL versions 1.0.2 through 1.0.2y Description The issue is related to the representation of ASN.1 strings within OpenSSL as an ASN1 STRING structure, which contains a buffer holding the string data and...

PT-2021-5752 · Ntfs-3G +7 · Ntfs-3G +7

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions prior to 2021.8.22 Description: The issue is related to an out-of-bounds access in the ntfs inode sync standard information function of the NTFS-3G driver for the FUSE module. This can be triggered by a crafted NTFS image,...