PT-2021-18384 · Pomerium · Pomerium

Name of the Vulnerable Software and Affected Versions: Pomerium versions 0.10.0 through 0.13.3 Description: The issue is related to an Open Redirect in the user sign-in/out process. Some API endpoints under /.pomerium/ do not verify parameters with pomerium signature, which could allow modifying...

PT-2021-14491 · Unknown +2 · Django-Rest-Registration +2

Name of the Vulnerable Software and Affected Versions: django-registration versions prior to 3.1.2 Description: The django-registration package has an issue where the base user-account registration view does not properly apply filters to sensitive data. This can result in sensitive data being...

PT-2021-7302

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 7.2.2 through 9.4.38 Eclipse Jetty versions 10.0.0.alpha0 through 10.0.1 Eclipse Jetty versions 11.0.0.alpha0 through 11.0.1 Description The issue is related to an uncontrolled resource consumption in Eclipse Jetty, whic...

VMware vRealize Operations Manager SSRF和文件读取漏洞（CVE-2021-21975 CVE-2021-21983）

Description On March 30, 2021, VMware published a security advisory for CVE-2021-21975 and CVE-2021-21983, two chainable vulnerabilities in its vRealize Operations Manager product. CVE-2021-21975 is an unauthenticated server-side request forgery SSRF, while CVE-2021-21983 is an authenticated...

PT-2021-4546

Name of the Vulnerable Software and Affected Versions Composer versions prior to 1.10.22 Composer versions prior to 2.0.13 Description The issue is related to the incorrect sanitization of URLs for Mercurial repositories in the root composer.json and package source download URLs. This allows...

Authorization

OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...

Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i is affected by CVE-2020-14782

Summary IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ is supported by IBM i. IBM i has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an...

PT-2021-17832 · Ca · Ca Ehealth Performance Manager

Name of the Vulnerable Software and Affected Versions: CA eHealth Performance Manager versions 6.3.2.12 and earlier Description: The issue allows an authenticated remote user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data, performing a Reflected...

PT-2021-14892 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.4 and later Description: An issue has been discovered in GitLab, where improper access control allows unauthorized users to access details on analytic pages. Recommendations: For versions 13.4 and later, update to a version...

Amazon Linux AMI : git (ALAS-2021-1490)

The version of git installed on the remote host is prior to 2.18.5-2.73. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1490 advisory. Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains...

FreeBSD-SA-21:07.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:07.openssl Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in OpenSSL Category: contrib Module: openssl Announced: 2021-03-25 Affects:...

PT-2021-2506 · Cisco · Cisco Aironet Access Points

Name of the Vulnerable Software and Affected Versions: Cisco Aironet Access Points affected versions not specified Description: The issue is related to insufficient input validation for a specific command in the implementation of a CLI command, which could allow an authenticated, local attacker t...

Out of bounds read in AD DC LDAP server

Description A string in an LDAP attribute that contains multiple consecutive leading spaces can lead to a memmove of out of bounds memory in ldbhandlerfold. ldbhandlerfold is used by case insensitive strings - that is most string attributes - in Active Directory. As the search expression is...

Rating Script Service expose XWiki to SQL injection

Impact This issue impacts only XWiki with the Ratings API installed. The Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. This might lead to an SQL script injection quite easily for any user having Script rights on XWiki. Patches Th...

GHSA-V662-XPCC-9XF6 It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro

Impact The wikimacrocontent executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro very often a user which has Programming rights...

It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro

Impact The wikimacrocontent executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro very often a user which has Programming rights...

Security Bulletin: A security vulnerability has been identified in IBM® SDK, Java™ Technology Edition shipped with IBM Tivoli Netcool Impact (CVE-2020-14782)

Summary IBM® SDK, Java™ Technology Edition is shipped as a component of IBM Tivoli Netcool Impact. Information about security vulnerabilities affecting IBM® SDK, Java™ Technology Edition has been published in a security bulletin. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An...

PT-2021-15237 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.0.3 GitHub Enterprise Server version 2.22.9 GitHub Enterprise Server version 2.21.17 Description: A remote code execution issue was identified in GitHub Enterprise Server that could be exploited wh...

PT-2021-14478 · Nanopb +2 · Nanopb +2

Name of the Vulnerable Software and Affected Versions: Nanopb versions prior to 0.3.9.8 and 0.4.5 Description: Decoding a specifically formed message can cause invalid free or realloc calls if the message type contains an oneof field, and the oneof directly contains both a pointer field and a...

GHSA-F6HM-88X3-MFJV A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the...