CVE-2021-32756 Arbitrary eval through MiqExpression

ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to...

Fortics sz.chat has an unspecified vulnerability

Fortics sz.chat is a messaging app from the Brazilian company Fortics. version 4 of Fortics sz.chat has a security vulnerability that could be exploited by attackers to inject web script and HTML into the message box...

Code injection

sz.chat version 4 allows injection of web scripts and HTML in the message box...

CVE-2021-3279

The CVE-2021-3279 entry concerns sz.chat v4, where the message box allows injection of web scripts and HTML. Connected sources (Red Hat, CNVD, CVE listings, CNNVD, PRION) confirm the affected product and issue but do not provide a detailed root cause, exploited vectors, or a remediation. The vuln...

CVE-2021-20423

IBM Cloud Pak for Applications 4.3 could allow an authenticated user gain escalated privilesges due to improper application permissions. IBM X-Force ID: 196308...

Debian: Security Advisory (DLA-2705-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-34190

A stored cross site scripting XSS vulnerability in index.php?menu=billingrates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Name" or "Prefix" fields under the "Create New Rate" module...

Virtuozzo Hybrid Server 7.5 Update 1 Hotfix 4 (7.5.1-739)

The Hotfix 4 for Virtuozzo Hybrid Server 7.5 Update 1 provides a stability and usability bug fix. Vulnerability id: PSBM-130698 Migrating a container from Virtuozzo 6 to Virtuozzo Hybrid Server 7 with the '--keep-src' option could result in duplicate UUIDs in 'prlctl list' output on the destinati...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager

💥 BUG Stored xss via signup page 💥 VERSION TESTED latest version as of 4/7/21 💥 IMPACT xss allow to execute arbitary javascript in vicitm account 💥 STEP TO REPRODUCE 1. goto http://localhost/online-rental/app/admin/pageSettings.php and click on Sign Up tab . Here allow signup.\ now put bellow xss...

[SECURITY] Fedora 34 Update: libslirp-4.4.0-4.fc34

A general purpose TCP-IP emulator used by virtual machine hypervisors to provide virtual networking services...

Advisory ROSA-SA-2021-1806

Software: aspell 0.60.6.1 OS: Cobalt 7.9 CVE-ID: CVE-2019-20433 CVE-Crit: CRITICAL CVE-DESC: libaspell.a in GNU Aspell before 0.60.8 has a buffer reread for a string ending with one byte '\ 0' if the encoding is set to ucs-2 or ucs-4 outside the application. , as shown by the ASPELLCONF environme...

Denial Of Service (DoS)

Aspell is vulnerable to denial of service. A buffer over-read for a string ending with a single \0 when the encoding is set to ucs-2 or ucs-4 outside of the application results in an application crash...

GSD-2021-1001017 spi: bcm2835: Fix out-of-bounds access with more than 4 slaves

spi: bcm2835: Fix out-of-bounds access with more than 4 slaves This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.11 by commit...

CVE-2021-35970: Incorrect Comparison

Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an incorrect data type...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational ClearQuest

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM Rational ClearQuest. IBM Rational ClearQuest has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-23839 DESCRIPTION: OpenSSL could provide weaker than expected security, caused by...

Citrix Applayering - Unable to install Microsoft Office 365 into new layer Packaging machine fails with Error Code 30010-4

...

VMware vCenter 6.5 / 6.7 / 7.0 Remote Code Execution

Exploit Title: VMware vCenter Server RCE 6.5 / 6.7 / 7.0 - Remote Code Execution RCE Unauthenticated Date: 06/21/2021 Exploit Author: CHackA0101 Vendor Homepage: https://kb.vmware.com/s/article/82374 Software Link: https://www.vmware.com/products/vcenter-server.html Version: This affects VMware...

Threat Roundup for June 4 to June 11

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 4 and June 11. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

CVE-2021-33829

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

Cross site scripting

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...