Security CERT Global

• ESB-2021.0289 – [Ubuntu] Pound: Multiple vulnerabilities
  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0289 USN-4702-1: Pound vulnerabilities 27 January 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Pound Publisher: Ubuntu Operating ... read more
• ESB-2021.0290 – [Ubuntu] libsndfile: Multiple vulnerabilities
  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0290 USN-4704-1: libsndfile vulnerabilities 27 January 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: libsndfile Publisher: Ubuntu Operating ... read more
• CVE-2021-3165
  SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI. ... read more
• CVE-2013-2512
  The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic. ... read more
• CVE-2021-3317
  KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter. ... read more
• ESB-2021.0283 – [RedHat] dnsmasq: Multiple vulnerabilities
  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0283 dnsmasq security update 27 January 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: dnsmasq Publisher: Red Hat ... read more
• ESB-2021.0288 – [Ubuntu] mutt: Denial of service – Remote with user interaction
  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0288 USN-4703-1: Mutt vulnerability 27 January 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: mutt Publisher: Ubuntu Operating ... read more
• ESB-2021.0284 – [Win][UNIX/Linux] Jenkins Core: Multiple vulnerabilities
  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0284 Jenkins Security Advisory 2021-01-26 27 January 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Jenkins Core Publisher: ... read more
• ESB-2021.0282 – [RedHat] OpenShift Container Platform 4.6.13: Access confidential data – Existing account
  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0282 OpenShift Container Platform 4.6.13 bug fix and security update 27 January 2021 =========================================================================== AusCERT Security Bulletin Summary ... read more
• ESB-2021.0287 – [Ubuntu] Sudo: Multiple vulnerabilities
  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0287 USN-4705-1: Sudo vulnerabilities 27 January 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Sudo Publisher: Ubuntu Operating ... read more
• ESB-2021.0285 – [SUSE] rubygem-nokogiri: Multiple vulnerabilities
  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0285 Security update for rubygem-nokogiri 27 January 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: rubygem-nokogiri Publisher: SUSE ... read more
• ESB-2021.0286 – [RedHat] Red Hat JBoss Enterprise Application Platform 7.3.5: Multiple vulnerabilities
  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0286 Red Hat JBoss Enterprise Application Platform 7.3.5 security update 27 January 2021 =========================================================================== AusCERT Security Bulletin Summary ... read more
• ESB-2021.0281 – [RedHat] sudo: Root compromise – Existing account
  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0281 sudo security update 27 January 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: sudo Publisher: Red Hat ... read more
• Weekly Report: 複数のCisco製品に脆弱性
  複数のCisco製品には、脆弱性があります。結果として、遠隔の第三者が任意のコマンドを実行するなどの可能性があります。続きを読む ... read more
• Weekly Report: TP-Link製TL-WR841N V13（JP）におけるOSコマンドインジェクションの脆弱性
  TP-Linkが提供するWi-FiルータTL-WR841NのハードウェアバージョンV13（JP）向けファームウェアには、OSコマンドインジェクションの脆弱性があります。結果として、当該製品のwebインタフェースにログインできるユーザが、ファームウェアのデザイン上想定されていないOSコマンドを実行する可能性があります。続きを読む ... read more
• Weekly Report: Drupalのサードパーティライブラリに脆弱性
  Drupalには、内部で使用しているパッケージの問題に起因する、アーカイブファイル処理時のシンボリックリンクの不十分なチェックによるディレクトリトラバーサルの脆弱性があります。結果として、遠隔の第三者が任意のファイルを上書きする可能性があります。続きを読む ... read more
• Weekly Report: Google Chromeに複数の脆弱性
  Google Chromeには、複数の脆弱性があります。続きを読む ... read more
• Weekly Report: 2021年1月Oracle Critical Patch Updateについて
  Oracleから複数の製品およびコンポーネントに含まれる脆弱性に対応したOracleCritical Patch Update Advisoryが公開されました。続きを読む ... read more
• Weekly Report: Dnsmasqに複数の脆弱性
  Dnsmasqは、DNSやDHCPなどの機能を提供するオープンソースソフトウェアです。Dnsmasqには、複数の脆弱性があります。結果として、遠隔の第三者が、任意のコード実行や情報の窃取を行ったり、サービス運用妨害（DoS）状態を引き起こしたりするなどの可能性があります。なお、これらの脆弱性は発見者によって「DNSpooq」と呼称されています。続きを読む ... read more
• お知らせ：JPCERT/CC 感染症対策への取り組みと問い合わせ対応について
  ... read more
• CVE-2021-21283
  Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the ... read more
• CVE-2021-21278
  RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use ... read more
• CVE-2021-26272
  It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or ... read more
• CVE-2021-1070
  NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions prior to 32.5, contains a vulnerability in the apply_binaries.sh script used to install NVIDIA ... read more
• CVE-2021-3156
  Sudo before 1.9.5p2 has a Heap-based Buffer Overflow, allowing privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character: ... read more
• CVE-2021-26271
  It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the ... read more
• CVE-2021-1071
  NVIDIA Tegra kernel in Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, all L4T versions prior to r32.5, contains a vulnerability in the INA3221 driver ... read more
• CVE-2020-23776
  A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a ... read more
• CVE-2020-23774
  A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed. ... read more
• CVE-2021-3309
  packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store, ... read more
• CVE-2021-21271
  Tendermint Core is an open source Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine - written in any programming language - and securely replicates it on many ... read more
• CVE-2020-27859 (esmpro_manager)
  This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ESMPRO Manager 6.42. Authentication is not required to exploit this vulnerability. The specific flaw exists within ... read more
• FTC Reports Scammers Impersonating FTC
  Original release date: January 26, 2021The Federal Trade Commission (FTC) has released information on scammers attempting to impersonate the FTC. The scammers operate an FTC-spoofed website that claims to provide ... read more
• CVE-2021-2057 (retail_customer_management_and_segmentation_foundation)
  Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Internal Operations). The supported version that is affected is 19.0. Easily exploitable vulnerability allows ... read more
• CVE-2021-2062 (business_intelligence_publisher)
  Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Web Server). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low ... read more
• CVE-2021-1283 (data_center_network_manager)
  A vulnerability in the logging subsystem of Cisco Data Center Network Manager (DCNM) could allow an authenticated, local attacker to view sensitive information in a system log file that should ... read more
• CVE-2020-25683 (dnsmasq, fedora)
  A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A ... read more
• CVE-2020-25687 (dnsmasq, fedora)
  A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This ... read more
• CVE-2020-25686 (dnsmasq, fedora)
  A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new ... read more
• CVE-2021-2059 (istore)
  Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Web interface). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network ... read more
• CVE-2021-2054 (rdbms_sharding)
  Vulnerability in the RDBMS Sharding component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any ... read more
• CVE-2021-1276 (data_center_network_manager)
  Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) could allow an attacker to spoof a trusted host or construct a man-in-the-middle attack to extract sensitive information or alter certain ... read more
• CVE-2021-1277 (data_center_network_manager)
  Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) could allow an attacker to spoof a trusted host or construct a man-in-the-middle attack to extract sensitive information or alter certain ... read more
• CVE-2020-27274
  Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to close, which may lead to a ... read more
• CVE-2021-22159
  Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint Insider Threat Management (formerly ObserveIT) Agent for Windows before 7.4.3, 7.5.4, 7.6.5, 7.7.5, 7.8.4, 7.9.3, 7.10.2, and 7.11.0.25 as ... read more
• CVE-2020-13582
  A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of service. An attacker can send an HTTP ... read more
• CVE-2021-3308
  An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through devices can force the allocation of all IDT vectors ... read more
• CVE-2020-27295
  The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on the OPC UA Tunneller (versions prior to 6.3.0.8233). ... read more
• CVE-2021-23272
  The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged ... read more
• CVE-2020-27299
  The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information or cause the device to crash on the OPC ... read more
Older posts