A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.

DEBIAN:DSA-4958 | URL:https://www.debian.org/security/2021/dsa-4958 | FEDORA:FEDORA-2021-10d7331a31 | URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/ | FEDORA:FEDORA-2021-be94728b95 | URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/ | MISC:https://bugzilla.redhat.com/show_bug.cgi?id=1946314 | URL:https://bugzilla.redhat.com/show_bug.cgi?id=1946314 | MLIST:[debian-lts-announce] 20210830 [SECURITY] [DLA 2750-1] exiv2 security update | URL:https://lists.debian.org/debian-lts-announce/2021/08/msg00028.html

Web Path Directory Traversal in the Novus HTTP Server. The Novus HTTP Server is affected by the Directory Traversal for Arbitrary File Access vulnerability. A remote, unauthenticated attacker using an HTTP GET request may be able to exploit this issue to access sensitive data. The issue was discovered in the NMS (Novus Management System) software through 1.51.2

FULLDISC:20210709 Novus Managment System Vulnerabilities (CVE-2021-34820, CVE-2021-38421) | URL:http://seclists.org/fulldisclosure/2021/Jul/20 | MISC:http://packetstormsecurity.com/files/163453/Novus-Management-System-Directory-Traversal-Cross-Site-Scripting.html

Cross Site Scripting (XSS) vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remote, unauthenticated attacker may be able to exploit the issue by sending malicious HTTP requests to non-existing URIs. The value of the URL path filename is copied into the HTML document as plain text tags.

FULLDISC:FULLDISC: 20210709 Novus Managment System Vulnerabilities (CVE-2021-34820, CVE-2021-38421) | URL:https://seclists.org/fulldisclosure/2021/Jul/20

The ON24 ScreenShare (aka DesktopScreenShare.app) plugin before 2.0 for macOS allows remote file access via its built-in HTTP server. This allows unauthenticated remote users to retrieve files accessible to the logged-on macOS user. When a remote user sends a crafted HTTP request to the server, it triggers a code path that will download a configuration file from a specified remote machine over HTTP. There is an XXE flaw in processing of this configuration file that allows reading local (to macOS) files and uploading them to remote machines.

MISC:https://www.trustwave.com/en-us/resources/security-resources/security-advisories/ | MISC:https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29105

Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces.

MISC:https://github.com/istio/istio/releases | MISC:https://istio.io/latest/news/security/istio-security-2021-007

Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system.

FEDORA:FEDORA-2021-2e2ba6d39f | URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JOFTSGJUJHCA3KGQBO6OZXWU7JFKVHMJ/ | FEDORA:FEDORA-2021-75cec6e6da | URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZFWRN5P2WG23MWMVAEVV3YBHGFJHDSW/ | MISC:https://github.com/quassel/quassel/pull/581

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the SOAPAction HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12029.

MISC:https://www.zerodayinitiative.com/advisories/ZDI-21-679/ | URL:https://www.zerodayinitiative.com/advisories/ZDI-21-679/

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the SOAPAction HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12066.

MISC:https://www.zerodayinitiative.com/advisories/ZDI-21-680/ | URL:https://www.zerodayinitiative.com/advisories/ZDI-21-680/

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the HNAP_AUTH HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12065.

MISC:https://www.zerodayinitiative.com/advisories/ZDI-21-681/ | URL:https://www.zerodayinitiative.com/advisories/ZDI-21-681/