CVE-2021-1826

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may lead to universal cross site scripting...

CVE-2021-1817

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may lead to arbitrary code execution...

PHP 7.3.x < 7.3.29 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 7.3.x prior to 7.3.29, 7.4.x prior to 7.4.21, or 8.x prior to 8.0.8. It is, therefore, affected by multiple vulnerabilities: - Server-Side Request Forgery SSRF bypass in FILTERVALIDATEURL...

CVE-2021-21704

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute, execute, fetch and others by returning invalid response data that is not...

Security Bulletin: Multiplie vulnerabilities Have Been Identified In IBM Security Verify Privilege Manager

Summary Multiplie vulnerabilities identified in IBM Security Verify Privilege Manager previously known as IBM Security Privilege Manager has been addressed in the release 11.0 Vulnerability Details CVEID: CVE-2020-4609 DESCRIPTION: IBM Security Sevret Server is vulnerable to a buffer overflow,...

CVE-2021-20380

CVE-2021-20380 affects IBM QRadar Advisor With Watson App (versions 1.1–2.5) used with IBM QRadar SIEM 7.4, where a remote attacker could obtain sensitive information from HTTP requests, enabling potential further attacks. The incident originates from information exposure within the QRadar Adviso...

CVE-2021-3424

A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges...

webkitgtk: Logic issue leading to universal cross site scripting attack

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may lead to universal cross site scripting...

PHP 7.4.x < 7.4.18 Header Injection Vulnerability

According to its self-reported version number, the version of PHP installed on the remote host is 7.3.x prior to 7.3.28, 7.4.x prior to 7.4.18, or 8.x prior to 8.0.5. It is, therefore, affected by a header injection via imapmailcompose. Note that the scanner has not tested for these issues but ha...

Voting System 1.0 - Authentication Bypass Vulnerability

Exploit Title: Voting System 1.0 - Authentication Bypass SQLI Exploit Author: secure77 Vendor Homepage: https://www.sourcecodester.com/php/12306/voting-system-using-php.html Software Link: https://www.sourcecodester.com/download-code?nid=12306&title=Voting+System+using+PHP%2FMySQLi+with+Source+Co...

IBM QRadar SIEM Cross-Site Scripting Vulnerability (CNVD-2021-40869)

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. A cross-site...

IBM QRadar SIEM Path Traversal Vulnerability

QRadar SIEM is an IBM enterprise security information and event management product that consolidates log event and network flow data from thousands of devices, endpoints and applications scattered across the network. A path traversal vulnerability exists in the way IBM QRadar SIEM versions 7.3 an...

CVE-2020-5013

IBM QRadar SIEM 7.3 and 7.4 may vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 193245...

Code injection

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to comprimise or spoof traffic between hosts may be able to execute arbitrary commands. IBM X-Force D: 192538...

CVE-2020-5013

CVE-2020-5013 affects IBM QRadar SIEM 7.3.x (7.3.0–7.3.3 Patch 7) and 7.4.x (7.4.0–7.4.2 Patch 2). The issue is an XML External Entity (XXE) injection when processing XML data, enabling a remote attacker to potentially disclose sensitive information or exhaust memory/CPU resources. Mitigations/Re...

CVE-2020-4993

CVE-2020-4993 – IBM QRadar SIEM path traversal : QRadar SIEM versions 7.3.0–7.3.3 Patch 7 and 7.4.0–7.4.2 Patch 2 are vulnerable when decompressing or verifying the signature of ZIP files. The root cause is improper handling during ZIP data processing, enabling path traversal. Basescore 4.9 (CVSS...

CVE-2020-4979

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to comprimise or spoof traffic between hosts may be able to execute arbitrary commands. IBM X-Force D: 192538...

CVE-2020-4979

CVE-2020-4979 affects IBM QRadar SIEM 7.3.x and 7.4.x, where insecure inter‑deployment communication can enable an attacker who can compromise or spoof traffic between hosts to execute arbitrary commands. Root cause is insecure inter‑deployment communications between QRadar components. Impact is ...

CVE-2020-4932

CVE-2020-4932 affects IBM QRadar SIEM 7.3.x and 7.4.x. Root cause: hard-coded credentials used for inbound authentication, outbound communication, or internal data encryption. Impact: potential disclosure or misuse of embedded credentials. Affected versions per sources: QRadar 7.3.0–7.3.3 Patch 7...

CVE-2020-4929

IBM QRadar SIEM is affected by CVE-2020-4929, a Cross-Site Scripting (XSS) vulnerability in the Web UI. Affected versions include QRadar 7.3.0–7.3.3 Patch 7 and 7.4.0–7.4.2 Patch 2. The underlying issue permits embedding arbitrary JavaScript in the Web UI, with potential credential disclosure wit...