roaring-landmask (0.4.0) potentially affected by CVE-2021-4044 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2021-4044 Source advisory: OSV:GHSA-MMJF-F5JW-W72Q...

VMSA-2021-0028:VMware Response to Apache Log4j Remote Code Execution Vulnerabilities

Advisory ID: VMSA-2021-0028.13 CVSSv3 Range: 9.0-10.0 Issue Date:2021-12-10 Updated On: 2022-04-14 CVEs: CVE-2021-44228, CVE-2021-45046 Synopsis: VMware Response to Apache Log4j Remote Code Execution Vulnerabilities CVE-2021-44228, CVE-2021-45046 RSS Feed Download PDF Download Text File Share thi...

Vulnerability fixed in Zoho ManageEngine ADSelfService Plus

Zoho ManageEngine has fixed a vulnerability in ADSelfService Plus. ADSelfService Plus is a self-service password management and single-sign-on solution. The vulnerability allows a malicious remote user the ability to execute arbitrary code. The FBI, CISA and CGCYBER, have issued a joint security...

SUSE SLED12: libpcre1 / libpcre1-32bit / libpcre16-0 / libpcrecpp0 / etc (SUSE-SU-2021:3652-1)

The remote SUSE Linux SLED12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3652-1 advisory. Update pcre to version 8.45: - CVE-2020-14155: Fixed integer overflow via a large number after a '?C' substring bsc1172974...

F5 Networks BIG-IP : OpenSSL vulnerability (K24624116)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.4.6 / 15.1.5.1 / 16.1.2.2 / 17.0.0. It is, therefore, affected by a vulnerability as referenced in the K24624116 advisory. Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length...

GHSA-5VP3-V4HC-GX76 UUPSUpgradeable vulnerability in @openzeppelin/contracts

Impact Upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon. Patches A fix is included in version 4.3.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeabl...

acid-store (>=0.12.0, <=0.14.2), aliyundrive-fuse (>=0.1.0, <=0.1.14) +40 more potentially affected by unknown CVE via fuser (>=0.7.0, <=0.15.1)

fuser CARGO version =0.7.0, =0.12.0, =0.1.0, =0.2.4, =1.0.0, =0.2.0, =0.1.0, =0.1.0, =0.1.2, =0.6.0, =1.5.5, =0.2.5, =0.1.2, =0.5.2 and more Source cves: unknown CVE Source advisory: SNYK:RUST-FUSER-12671322...

Cisco IOS XR Software Arbitrary File Read and Write Vulnerability

A vulnerability in the SSH Server process of Cisco IOS XR Software could allow an authenticated, remote attacker to overwrite and read arbitrary files on the local device. This vulnerability is due to insufficient input validation of arguments that are supplied by the user for a specific file...

a2 (>=0.5.0-alpha.6, <=0.5.0-alpha.7), azure_sdk_auth_aad (>=0.30.0, <=0.35.0) +19 more potentially affected by CVE-2020-35875 via tokio-rustls (>=0.12.0-alpha.1, <=0.12.0-alpha.8)

tokio-rustls CARGO version =0.12.0-alpha.1, =0.5.0-alpha.6, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.1.0-alpha.1, =0.1.0, =0.30.0, =3.2.2, =3.4.2 and more Source cves: CVE-2020-35875 Source advisory: OSV:GHSA-2JFV-G3FH-XQ3V...

Microsoft Edge (Chromium) < 92.0.902.78 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 92.0.902.78. It is, therefore, affected by multiple vulnerabilities as referenced in the August 19, 2021 advisory. - Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to...

SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:2438-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2438-1 advisory. The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: ...

ferris-rich-input (0.0.1) potentially affected by CVE-2021-33829 via ckeditor4 (4.14.0)

ckeditor4 NPM version 4.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on ckeditor4 and may be impacted: - ferris-rich-input 0.0.1 Source cves: CVE-2021-33829 Source advisory: OSV:GHSA-RGX6-RJJ4-C388...

CVE-2020-10065

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Length Parameter Inconsistency CWE-130. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c...

OPENSUSE-SU-2021:0728-1 Security update for prosody

This update for prosody fixes the following issues: prosody was updated to 0.11.9: Security: modlimits, prosody.cfg.lua: Enable rate limits by default certmanager: Disable renegotiation by default modproxy65: Restrict access to local c2s connections by default util.startup: Set more aggressive...

photo-cleanup (>=1.4.2, <=1.5.0) potentially affected by unknown CVE via exiftool-vendored (14.0.0)

exiftool-vendored NPM version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on exiftool-vendored and may be impacted: - photo-cleanup =1.4.2, =1.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-4WHQ-R978-2X68...

Yomi-Search vulnerable to cross-site scripting

Overview Yomi-Search provided by WonderLink is a directory type search engine program. Yomi-Search contains a cross-site scripting vulnerability CWE-79. During the meeting of Committee for authorizing the disclosure of unresolved vulnerabilities held on January 22, 2021, it was judged that an...

byte-common (1.0.0), registry-sync (>=2.4.1, <=2.4.6) potentially affected by CVE-2021-27290 via ssri (>=7.0.0, <=7.1.0)

ssri NPM version =7.0.0, =2.4.1, =2.4.6 Source cves: CVE-2021-27290 Source advisory: OSV:GHSA-VX3P-948G-6VHQ...

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Factory Reset (Unauthenticated)

Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Factory Reset Unauthenticated Date: 03.02.2021 Exploit Author: LiquidWorm Vendor Homepage: http://www.kzbtech.com http://www.jatontec.com https://www.neotel.mk Vendor: KZ Broadband Technologies, Ltd. | Jaton Technology, Ltd. Product...

1tp (>=0.0.1, <=0.11.2), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +2802 more potentially affected by CVE-2020-28502 via xmlhttprequest-ssl (>=1.5.1, <=1.5.5)

xmlhttprequest-ssl NPM version =1.5.1, =0.0.1, =1.0.2, =4.11.25, =0.1.3, =0.0.15, =8.25.29, =1.0.0, =0.0.4, =1.0.9, =0.2.9-dev-10, =0.13.0-alkemio, =0.17.0-alkemio-1 and more Source cves: CVE-2020-28502 Source advisory: SNYK:JS-XMLHTTPREQUESTSSL-1082936...

@zpmc/zwd-server (>=0.0.14, <=0.0.21) potentially affected by CVE-2020-26299 via ftp-srv (4.1.0)

ftp-srv NPM version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ftp-srv and may be impacted: - @zpmc/zwd-server =0.0.14, =0.0.21 Source cves: CVE-2020-26299 Source advisory: OSV:GHSA-PMW4-JGXX-PCQ9...