Red Hat Security Advisory 2021-3642-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
e5ea0b25b2d39793003ba5a3c2f5ece3db0e42eeb9158570c160ffde10c19998Pet Shop Management System version 1.0 suffers from a remote shell upload vulnerability.
28477ad85ab4111f1df3679d0ad89f7074a8bafd27483d7ca25f37d1c4298c64Ubuntu Security Notice 5092-2 - Valentina Palmiotti discovered that the io_uring subsystem in the Linux kernel could be coerced to free adjacent memory. A local attacker could use this to execute arbitrary code. Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack. An attacker could use this to expose sensitive information. Various other issues were also addressed.
fe6e6f7b890fe9c454e6d8b6981a93e9900e3e12cc8de38080233a23b6f9f395Mitrastar GPT-2541GNAC-N1 suffers from a privilege escalation vulnerability that provides root privileges.
79eee6856f1f12654bc6bb4b93dba0735934aa5df9b92db70648672e0168b534Google's Extensible Service Proxy suffers from a header forgery vulnerability.
c2a95ac806be1e61288f44e7ec319f21ec2702adefa41386a2ad0039ac44ff37Ubuntu Security Notice 5094-1 - It was discovered that the KVM hypervisor implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. An attacker who could start and control a VM could possibly use this to expose sensitive information or execute arbitrary code. It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu ring buffer state. A privileged attacker could use this to cause a denial of service. Various other issues were also addressed.
61410dbe4257dd87ae714e3f86a082bb3acae0802b9d7ce2e4fc034d086c4838Storage Unit Rental Management System version 1.0 suffers from a remote shell upload vulnerability.
40921e68c1ec93ec4338b185d832ad6b9271cae7bd61a5da66366bf26fd606e0Ubuntu Security Notice 5090-4 - USN-5090-1 fixed vulnerabilities in Apache HTTP Server. One of the upstream fixes introduced a regression in UDS URIs. This update fixes the problem. James Kettle discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain crafted methods. A remote attacker could possibly use this issue to perform request splitting or cache poisoning attacks. It was discovered that the Apache HTTP Server incorrectly handled certain malformed requests. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. Li Zhi Xin discovered that the Apache mod_proxy_uwsgi module incorrectly handled certain request uri-paths. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 21.04. It was discovered that the Apache HTTP Server incorrectly handled escaping quotes. If the server was configured with third-party modules, a remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. It was discovered that the Apache mod_proxy module incorrectly handled certain request uri-paths. A remote attacker could possibly use this issue to cause the server to forward requests to arbitrary origin servers. Various other issues were also addressed.
97566fcdf572aabba3700b134cb12c430056ecb69fad0c05e485f33bb178308aWordPress Redirect 404 to Parent plugin version 1.3.0 suffers from a cross site scripting vulnerability.
f4ebfcd69e7f5176c540dbe75f7090e041c52868c64e8097859a7b178f1d3f4bWordPress Select All Categories And Taxonomies plugin version 1.3.1 suffers from a cross site scripting vulnerability.
68fc9f4058f733ea1e46d65dc918535536c09807be809a6fe766a63989c5c709OpenSIS version 8.0 suffers from a cross site scripting vulnerability.
bac5d8f25561abe1b7b4f87c94bf527231e8fcd6a9f8623f5506441d4deed74cTsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence. It was originally written by Google and open sourced in July of 2020.
9e5527ca4b40f218f5fc3dcb8685bd4dd7fecf7330f37e0ad5242e442db55a6bCovid Vaccination Scheduler System version 1.0 suffers from cross site scripting and remote SQL injection vulnerabilities. Original discovery of SQL injection in this version is attributed to faisalfs10x in July of 2021.
ae710b05bd025d7e79e63517677882000a5dc8e341484db8f13afd0794170b66Debian Linux Security Advisory 4967-1 - Etienne Stalmans discovered that unsquashfs in squashfs-tools, the tools to create and extract Squashfs filesystems, does not validate filenames for traversal outside of the destination directory. An attacker can take advantage of this flaw for writing to arbitrary files to the filesystem if a malformed Squashfs image is processed.
c7522b4eeabe8c9588e7d48cd0cc114c4b00a72b7777470016051ed6fbc09d70Debian Linux Security Advisory 4968-1 - Ori Hollander reported that missing header name length checks in the htx_add_header() and htx_add_trailer() functions in HAProxy, a fast and reliable load balancing reverse proxy, could result in request smuggling attacks or response splitting attacks.
722e6b1f007edff3fc58e6248446392cfef076d7541acd8ed38ea7e8add1a122Debian Linux Security Advisory 4969-1 - Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.
bbf752c06cdbb8161899c2f1532324e5f1f0e311ff5c48461e056792a520eef0Debian Linux Security Advisory 4970-1 - Kevin Israel discovered that Postorius, the administrative web frontend for Mailman 3, didn't validate whether a logged-in user owns the email address when unsubscribing.
d0c0d8c9e3c781e6faf36980659196a409ce5700fd69a57831a82485c7e65a85Debian Linux Security Advisory 4971-1 - Several vulnerabilities were discovered in NTFS-3G, a read-write NTFS driver for FUSE. A local user can take advantage of these flaws for local root privilege escalation.
507f001642bcc1403611d56627f15d6bf5b64ac341f2e2a5db931f2781606046Debian Linux Security Advisory 4972-1 - It was discovered that Ghostscript, the GPL PostScript/PDF interpreter, does not properly validate access for the "%pipe%", "%handle%" and "%printer%" io devices, which could result in the execution of arbitrary code if a malformed Postscript file is processed (despite the -dSAFER sandbox being enabled).
efae9a961b56c9384742b0eb52f6aecb392a18a59c1e854ecd4ad068889fe62bDebian Linux Security Advisory 4973-1 - Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code.
0d4113449ce1cada8dbb75e60d597373835145fb30048c182cc9a09fc054ee74Debian Linux Security Advisory 4974-1 - Two vulnerabilities were discovered in the Nextcloud desktop client, which could result in information disclosure.
6224cf36fc7db2027cb5f00f3a2dc2fcd4db77f937b2bcc3cd750746a1374493Debian Linux Security Advisory 4975-1 - Vulnerabilities have been discovered in the webkit2gtk web engine.
354b5be51d57f019107d08c3e6a1c194b278396fc086352a972819a0b4c52d4fDebian Linux Security Advisory 4976-1 - Vulnerabilities have been discovered in the webkit2gtk web engine.
2875eed4ac197c4faf5b97c96bb75a711a9936e46f225a9d62c0ce24f02dd76dDebian Linux Security Advisory 4977-1 - Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation, denial of service or information leaks.
d81161044e1a99166a8514342c122a44470dc3e7951d7c4383ff8fd3711141c2Debian Linux Security Advisory 4978-1 - Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.
58e6e00aeccd2d98b5f0fbd9438d9ad7fea0354cd2d4fc6a894c0d2ecc5f5d7f
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed