CVE-2021-20740

Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08NEC2.5.4a and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08NEC3.4.2 allow remote authenticated attackers to execute arbitrary...

Design/Logic Flaw

Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08NEC2.5.4a and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08NEC3.4.2 allow remote authenticated attackers to execute arbitrary...

CVE-2021-20740

CVE-2021-20740 affects Hitachi Virtual File Platform and NEC Storage M Series NAS Gateway NH4x/NH8x. Impact: remote authenticated attacker can execute arbitrary OS commands with root privileges via unspecified vectors. Affected versions: Hitachi VFP < 5.5.3-09 and < 6.4.3-09; NEC M Series N...

CVE-2021-20740

Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08NEC2.5.4a and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08NEC3.4.2 allow remote authenticated attackers to execute arbitrary...

WordPress Bookshelf plugin <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by ABISHEIK M in WordPress Bookshelf plugin versions = 2.0.4. Solution Deactivate and delete. This plugin has been closed as of May 25, 2021 and is not available for download. Reason: Security Issue...

CVE-2021-20740: Improper Neutralization of Special Elements used in an OS Command

Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08NEC2.5.4a and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08NEC3.4.2 allow remote authenticated attackers to execute arbitrary...

WordPress Glass plugin <= 1.3.2 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by ABISHEIK M in WordPress Glass plugin versions = 1.3.2. Solution This plugin has been closed as of May 26, 2021 and is not available for download. This closure is temporary, pending a full review...

Command Execution Vulnerability in the Operation and Maintenance Audit System of Beijing COSCO Kirin Technology Co.

Beijing COSCO KyLin Technology Co., Ltd. is a software development company mainly focusing on R&D. The main products of the company are COSCO KyLin Barrier Machine, KyLin SSL VPN, KyLin Dynamic Password System, KyLin Cloud Desktop and so on. A command execution vulnerability exists in the operati...

CVE-2021-23845

This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from...

CVE-2021-23845 B426 Web Configuration Authentication Bypass

This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from...

JVN#21298724: Hitachi Virtual File Platform vulnerable to OS command injection

Hitachi Virtual File Platform provided by Hitachi contains an OS command injection vulnerability CWE-78 due to a flaw in processing parameters of the HTTP requests. Impact A remote attacker who can log in to the product may execute an arbitrary OS command with root privilege. Solution Update the...

CVE-2021-25415

Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memory as writable...

Intel Core Processors 信息泄露漏洞

Intel Core Processors is an Intel Core family of central processing units CPUs from Intel Corporation USA. A security vulnerability exists in Intel Core Processors with Radeon RX Vega M GL Graphics, which stems from a potential security flaw in the integrated graphics of Intel Core processors tha...

SQL Injection Vulnerability in Xinhua SecPath U200-M

H3C SecPath U200-M is a new-generation UTM United Threat Management device designed by H3C for small and medium-sized enterprises/branch offices. The H3C SecPath U200-M suffers from an SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Bosch多个产品访问控制错误漏洞

Bosch B426 and others are a firmware from Bosch Germany. An access control error vulnerability exists in multiple Bosch products that stems from the use of hard-coded session tokens in the lgs.cgi module. The vulnerability allows remote attackers to bypass the authentication of the affected Bosch...

The vulnerability of the pdkim_finish_bodyhash() function in the Exim message transport agent, related to reading beyond the buffer in memory, allows an attacker to access confidential information.

The vulnerability of the pdkimfinishbodyhash function in the Exim message transport agent is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information...

Unspecified Vulnerability in Trusted Firmware-M

Acorn Trusted Firmware-M TFM is an open source software from Acorn UK that runs in a hardware-isolated security environment and provides security services. A security vulnerability exists in Trusted Firmware-M version 1.3.0 and earlier versions, which can be exploited by an attacker to cause a...

CVE-2021-32032

In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation in the event of a failure can prevent the abort operation in the associated cryptographic library from freeing internal resources, causing a memory leak...

CVE-2021-32032

In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation in the event of a failure can prevent the abort operation in the associated cryptographic library from freeing internal resources, causing a memory leak...

Memory corruption

In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation in the event of a failure can prevent the abort operation in the associated cryptographic library from freeing internal resources, causing a memory leak...