Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
1,711 results · Feed
-
Unscored —
lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the func…
-
Low —
Temporary urls leaked via logging
In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are af…
-
Unscored —
An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions…
-
Unscored —
An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versi…
-
Unscored —
Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and incl…
-
Critical 9.8
go.uuid has Predictable UUID Identifiers
A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attac…
-
Unscored —
A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions befor…
-
High 7.5
Uncontrolled Resource Consumption in jboss-remoting
A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client reque…
-
Unscored —
An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attack…
-
Low 3.2
Cleartext Transmission of Sensitive Information in McAfee DBSec
Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to view the unencrypted password of the McAfee Insights Server used to pass data to the Ins…
-
Critical 9.0
Authorized deserialization of untrusted data in McAfee DBSec
Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized obj…
-
Critical 9.6
Unauthorized deserialization of untrusted data in McAfee DBSec
Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized o…
-
Medium 6.5
An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an…
-
Unscored —
A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were…
-
Unscored —
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger …
-
Unscored —
An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication t…
-
Unscored —
A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials thr…
-
Medium 5.9
Uncontrolled Resource Consumption in XNIO
A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.…
-
Unscored —
A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of…
-
Unscored —
A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network pac…
-
Unscored —
It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise App…
-
High 7.5
RESTEasy 4.5.5.Final in hash flooding
A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of servi…
-
Unscored —
A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects…
-
Unscored —
It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made …
-
Unscored —
A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to cras…
-
Medium 4.3
Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration…
-
Critical 9.8
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail compone…
-
High 7.2
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in …
-
High 7.7
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management compone…
-
High 7.5
Potential infinite loop in Pillow
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
-
Unscored —
KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a d…
-
Unscored —
aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
-
Medium 4.3
Malicious user could break user administration page
Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate us…
-
High 8.6
Trusted servers exchange can be triggered by attacker
Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link…
-
Medium 6.3
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
# Impact Due to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than…
-
Medium —
Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript
### Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before…
-
Medium —
Improper Verification of Cryptographic Signature in aws-encryption-sdk-cli
### Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before…
-
Medium —
Improper Verification of Cryptographic Signature in aws-encryption-sdk
### Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before…
-
Low 3.5
Files Drop public link can be added as federated share
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the shar…
-
High 8.1
Attacker can obtain write access to any federated share/public link
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, th…