Ubuntu Security Notice 5145-1 - Jacob Champion discovered that PostgreSQL incorrectly handled SSL certificate verification and encryption. A remote attacker could possibly use this issue to inject arbitrary SQL queries when a connection is first established.
0a95ded6de0e7c131df6f75fcd52434d727c24d1f5e7d16fd516ebe9ffed294cThis Metasploit module exploits local file inclusion and log poisoning vulnerabilities (CVE-2020-16152) in Aerohive NetConfig, version 10.0r8a build-242466 and older in order to achieve unauthenticated remote code execution as the root user. NetConfig is the Aerohive/Extreme Networks HiveOS administrative webinterface. Vulnerable versions allow for LFI because they rely on a version of PHP 5 that is vulnerable to string truncation attacks. This module leverages this issue in conjunction with log poisoning to gain remote code execution as root. Upon successful exploitation, the Aerohive NetConfig application will hang for as long as the spawned shell remains open. Closing the session should render the application responsive again. The module provides an automatic cleanup option to clean the log. However, this option is disabled by default because any modifications to the /tmp/messages log, even via sed, may render the target (temporarily) unexploitable. This state can last over an hour. This module has been successfully tested against Aerohive NetConfig versions 8.2r4 and 10.0r7a.
f4fce0d3935a3baeeca64e47d1f3ececd06846dd7a61129d94c68314b7e81dbbRed Hat Security Advisory 2021-4531-01 - The OpenJDK 17 packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. This release of the Red Hat build of OpenJDK 17 for Windows serves as the initial Windows release of OpenJDK 17. For further information, refer to the release notes linked to in the References section.
082e65c3466680b61175b95ae62fefca45ebd9871a01dee85f8faf2d71bbe8dbWordPress AccessPress Social Icons plugin version 1.8.2 suffers from a persistent cross site scripting vulnerability.
3d28795af2e5b7c30c8e0b1f47c5922424aba560fef29b28762e89efeb828946Red Hat Security Advisory 2021-4532-01 - The OpenJDK 17 packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. This release of the Red Hat build of OpenJDK 17 for portable Linux serves as the initial portable Linux release of OpenJDK 17. For further information, refer to the release notes linked to in the References section.
75037d8d382efe0c1ddc771fc434d6b6db41fdce63eb4f8363ef0b0eaec0fd31Xlight FTP version 3.9.3.1 suffers from a buffer overflow vulnerability.
3dabb6c449afa7a3c575affa67b35587c650c44ef61038914bd7c28eaba98ea7Ubuntu Security Notice 5144-1 - It was discovered that OpenEXR incorrectly handled certain EXR image files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
9828e32eeb5aefab2394f5b1f785c86678e0450cb349ce482ca5e6bbe7503f97WordPress WP Symposium Pro version 2021.10 suffers from a persistent cross site scripting vulnerability.
87bf68076d3cb18db38faa59c8db59d1a7f9b0580cd9b0b2ffed72024871b6faJann Horn discovered that the tty subsystem of the Linux kernel did not use consistent locking in some situations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). De4dCr0w of 360 Alpha Lab discovered that the BPF verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker could use this to expose sensitive information (kernel memory) or possibly execute arbitrary code. Various other vulnerabilities were also addressed.
4c43b77dc14ec38d515895508c90603e29e4435a67390143e2cb91e68bc70e9dMicrosoft MultiPoint Server 2011 version 6.1 Compilation 7601 Service Pack 1 suffers from an RpcEptMapper and Dnschade local privilege escalation vulnerability.
8be97a788656d251874f333f549ef913b4af5f496c16095cfdea95d98bc09ad5Red Hat Security Advisory 2021-4618-01 - Red Hat Advanced Cluster Management for Kubernetes 2.4.0 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs and security issues. Issues addressed include buffer overflow, denial of service, information leakage, integer overflow, out of bounds read, and path sanitization vulnerabilities.
14809d9261f291a519a153713fcca44c926124a2a48c8d989887911783dba47fMumara Classic versions 2.93 and below suffer from a remote SQL injection vulnerability.
92452b70f8e9fe54fbe27bb88ae426682962a9d7dcfd2dec517e8b15aa9ddde2Red Hat Security Advisory 2021-4621-01 - FreeRDP is a free implementation of the Remote Desktop Protocol, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
25f350c3b73b8f530c038049ac1c3390c0f3ed2f058a2b01c02ab2a56949da5a
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed