1313 matches found
CVE-2021-29987
After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to. This bug onl...
CVE-2021-38138
OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release...
Design/Logic Flaw
OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release...
CVE-2021-32066
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between th...
FreeBSD : go -- crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parameters (c365536d-e3cf-11eb-9d8d-b37b683944c2)
The Go project reports : crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected. The panic can be triggered by an attacker in a privileged network position without access to the server...
javaparser:parseFuzzer: Uncaught exception in com.github.javaparser.CommentsInserter.insertComments
Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=6490533848547328 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...
Man In The Middle (MitM)
ruby2.7 is vulnerable to Man In the Middle Attack. An attacker may bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack.”...
go -- crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parameters
The Go project reports: crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected. The panic can be triggered by an attacker in a privileged network position without access to the server...
Deserialization of untrusted data
DISPUTED Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load function in settings.py. NOTE: the vendor's position is that the product is not intended for...
CVE-2021-35196
Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load function in settings.py. NOTE: the vendor's position is that the product is not intended for opening an...
VulnCheck KEV: CVE-2017-1000253
Linux kernel contains a position-independent executable PIE stack buffer corruption vulnerability in loadelf binary that allows a local attacker to escalate privileges...
SUSE: Security Advisory (SUSE-SU-2021:1010-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Design/Logic Flaw
Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only...
CVE-2021-22747
Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that could cause module reset when TCM receives malformed TriStation packets while the write-protect keyswitch is in the program position. This CVE ID is unique...
CVE-2021-22743
Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TCM 4351B installed on Tricon V11.3.x systems that could cause module reset when TCM receives malformed TriStation packets while the write-protect keyswitch is in the program position...
CVE-2021-22747
Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that could cause module reset when TCM receives malformed TriStation packets while the write-protect keyswitch is in the program position. This CVE ID is unique...
PT-2021-18814
Name of the Vulnerable Software and Affected Versions macOS versions prior to Big Sur 11.4 Security Update versions prior to 2021-003 Catalina Security Update versions prior to 2021-004 Mojave Description An attacker in a privileged network position may be able to misrepresent application state d...
javaparser:parseFuzzer: Uncaught exception in com.github.javaparser.GeneratedJavaParser.Expression
Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=4531950535704576 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...
openSUSE Security Update : drbd-utils (openSUSE-2021-724)
This update for drbd-utils fixes the following issues : - make all binaries in position independent bsc1185132. This update was imported from the SUSE:SLE-15-SP2:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
OPENSUSE-SU-2021:0750-1 Security update for ibsim
This update for ibsim fixes the following issues: - Hardening: link as position independent executable bsc1184123. This update was imported from the SUSE:SLE-15-SP2:Update update project...