PT-2021-20138

Name of the Vulnerable Software and Affected Versions NumPy version 1.9.x Description A Buffer Overflow issue exists in the PyArray NewFromDescr int function of ctors.c when specifying arrays of large dimensions over 32 from Python code, which could let a malicious user cause a Denial of Service...

CVE-2021-24644

The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include function, which could lead to a Local File Inclusion issue...

PT-2021-16161

Name of the Vulnerable Software and Affected Versions: Images to WebP WordPress plugin versions prior to 1.9 Description: The issue concerns a Local File Inclusion problem due to insufficient validation or sanitization of the tab parameter before it is passed to the include function...

OESA-2021-1342 jackson security update

JSON processor written in Java., it also offers full node-based Tree Model, as well as full Object/Json Mapper data binding functionality. Security Fixes: A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also...

Advisory ROSA-SA-2021-1826

Software: ed 1.9 OS: Cobalt 7.9 CVE-ID: CVE-2015-2987 CVE-Crit: MEDIUM CVE-DESC: Type74 ED before 4.0 incorrectly uses 128-bit ECB encryption for small files, making it easier for attackers to obtain plaintext data by differential cryptanalysis of a file with an original length of less than 128...

GHSA-H45P-W933-JXH3 Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript

Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In...

CVE-2021-32642

radsecproxy is a generic RADIUS proxy that supports both UDP and TLS RadSec RADIUS transports. Missing input validation in radsecproxy's naptr-eduroam.sh and radsec-dynsrv.sh scripts can lead to configuration injection via crafted radsec peer discovery DNS records. Users are subject to Informatio...

CVE-2021-27372

Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the device with root permissions via the build-in network monitoring tool and execute arbitrary commands...

CVE-2021-27372

Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext in the built‑in network monitoring tool, which may allow an attacker to gain root access to the device and execute arbitrary commands. Affected component: RTL9601D SDK 1.9. Root cause: plaintext password storage. Impact: remote compromis...

Realtek xPON RTL9601D SDK 代码问题漏洞

Realtek xPON RTL9601D SDK is an application chip from Realtek China. It is used for network communication. Realtek xPON RTL9601D SDK 1.9 suffers from a code issue vulnerability that originates from a plaintext storage password, which can be exploited by an attacker to potentially gain access to a...

[SECURITY] [DLA 2556-1] unbound1.9 security update

Debian LTS Advisory DLA-2556-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany February 12, 2021 https://wiki.debian.org/LTS Package : unbound1.9 Version : 1.9.0-2+deb10u2deb9u1 CVE ID : CVE-2020-12662 CVE-2020-12663 CVE-2020-28935 Debian Bug : 977165 Several...

CVE-2020-7570

A CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting Stored vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect...

Schneider Electric EcoStruxure Building Operation WebReports 跨站脚本漏洞

EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of user-supplied data. A remote attacker...

Schneider Electric EcoStruxure Building Operation WebReports 跨站脚本漏洞

Schneider Electric EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in Schneider Electric EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of...

Apache Flink 1.9.x Shell Upload

!/usr/bin/env python3 coding: utf-8 Exploit Title: Apache Flink 1.9.x - File Upload RCE Unauthenticated Google Dork: None Date: 2020.11.01 Exploit Author: bigger.wing Vendor Homepage: https://flink.apache.org/ Software Link: https://flink.apache.org/downloads.html Version: 1.9.x Tested on:...

PT-2020-13680 · Vmware · Harbor

Name of the Vulnerable Software and Affected Versions: Harbor versions 1.9. through 2.0. Description: The issue allows exposure of sensitive information to an unauthorized actor. Authenticated users can exploit an enumeration vulnerability in Harbor. The vulnerability is present in the "/users" A...

HPE Pay Path Traversal Vulnerability (CNVD-2021-18034)

Hewlett Packard Enterprise, HPE HPE PPU service is a pay-per-use network service from Hewlett Packard Enterprise HPE in the United States. A path traversal vulnerability exists in HPE Pay prior to version 1.9 that originates in the doGet method of the ReceiverServlet class of PPU and UCS. An...

HPE Pay Path Traversal Vulnerability (CNVD-2021-18033)

Hewlett Packard Enterprise, HPE HPE PPU service is a pay-per-use network service from Hewlett Packard Enterprise HPE in the United States. A path traversal vulnerability exists in HPE Pay prior to version 1.9 that originates in the execute method of the DownloadServlet class of PPU and UCS. An...

CVE-2020-24625

Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

jackson-mapper-asl: XML external entity similar to CVE-2016-3720

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries such that an XML external entity XXE vulnerability affects codehaus's jackson-mapper-asl libraries. This vulnerability is similar to CVE-2016-3720. The primary threat from this flaw is data integrity...