CVE-2021-31833

Potential product security bypass vulnerability in McAfee Application and Change Control MACC prior to version 8.3.4 allows a locally logged in attacker to circumvent the application solidification protection provided by MACC, permitting them to run applications that would usually be prevented by...

CVE-2021-30283

Possible denial of service due to improper handling of debug register trap from user applications in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile...

CVE-2021-30283

Possible denial of service due to improper handling of debug register trap from user applications in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile...

CVE-2021-30283

CVE-2021-30283 concerns a Qualcomm/ Snapdragon-SoC DoS due to improper handling of traps in the debug registers of user applications. CNNVD lists affected Qualcomm products (e.g., QCA6391, QCM6490, QCS6490, QRB5165/5165N, SD778G, SD888 5G, SM7325P, WCN… variants) and confirms the root cause as tr...

vulhub

This is an open-source collection of vulnerable web applications and environments for security research and training. It is a repository of vulnerable systems, including web applications, databases, and other software, designed to help security professionals and researchers practice and improve...

Amios Emuse-eServices/eNvoice SQL Injection Vulnerability

Amios Emuse-eServices/eNvoice is an electronic invoicing service from the Israeli company Amios. It is a digital interface that simplifies the collection process and automatically sends invoices to customers via email.Amios Emuse-eServices/eNvoice suffers from a SQL injection vulnerability, which...

Log4Shell – Follow This Multi-Layered Approach for Detection and Remediation

Since the Log4Shell vulnerability was first discovered, Qualys has analyzed and responded to the threat in a systematic way approaching it from all angles – detection, mitigation and remediation. Recognizing the challenge it poses to large enterprises, we recommend that organizations follow a...

How to Discover Log4Shell Vulnerabilities in Running Containers & Images

If you run Java applications in containers, then it is critical that you check for Log4Shell vulnerabilities, given the high severity of this potential exploit. Qualys Container Security offers multiple methods to help you detect Log4Shell in your container environment. The Container Security...

Our Journey to Detect Log4j-Vulnerable Machines

Log4Shell CVE-2021-44228 is a remote code execution RCE vulnerability in the Apache-foundation open-source logging library Log4j. It was published on December 9, 2021, and then all hell broke loose. As Log4j is a common logging library for Java applications, it is highly widespread...

vulhub

This repository is an offensive tool for vulnerability research and exploitation, specifically targeting various web applications and services. It contains a collection of exploits and tools for identifying and exploiting vulnerabilities in software and systems. The repository includes a variety ...

SAP 3D Visual Enterprise Viewer Input Validation Error Vulnerability (CNVD-2022-33132)

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP Germany. The software supports publishing 2D and 3D scenes in all industry-standard desktop applications and supports separate installations as standalone executables and ActiveX spaces. SAP 3D Visual Enterprise Viewer version 9.0 is...

Huawei EulerOS: Security Advisory for flatpak (EulerOS-SA-2021-2799)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei HarmonyOS APK unverified signature during installation vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based, fully distributed operating system. Huawei HarmonyOS has a security vulnerability that could be exploited by attackers to isolate and read synchronization files from other applications via UID sandboxing...

CVE-2017-13910

An access issue was addressed with additional sandbox restrictions on applications. This issue is fixed in macOS High Sierra 10.13. An application may be able to access restricted files...

4-Year-Old Bug in Azure App Service Exposed Hundreds of Source Code Repositories

A security flaw has been unearthed in Microsoft's Azure App Service that resulted in the exposure of source code of customer applications written in Java, Node, PHP, Python, and Ruby for at least four years since September 2017. The vulnerability, codenamed "NotLegit," was reported to the tech...

SUSE: Security Advisory (SUSE-SU-2021:4153-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-21878

A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted series of HTTP requests can lead to local file inclusion. An attacker can make a series of authenticated HTTP requests to trigger thi...

CVE-2021-21878

CVE-2021-21878 affects Lantronix PremierWave 2050 (Web Manager Applications and FsBrowse). A local file inclusion vulnerability arises from an authorization mismatch when handling file-system operations: authenticated attackers can trigger LFI by sending crafted HTTP requests to the Web Manager/F...

Android Apps developed using Yappli fails to restrict custom URL schemes properly

Overview Yappli provided by Yappli, Inc. is an application development platform. Android Apps that are developed with Yappli provide the function to access a requested URL using Custom URL Scheme. The access to the function is not restricted properly CWE-939 which may be exploited to direct the A...

[SECURITY] Fedora 34 Update: jansi-2.1.1-4.fc34

Jansi is a small java library that allows you to use ANSI escape sequences in your Java console applications. It implements ANSI support on platforms which don't support it like Windows and provides graceful degradation for when output is being sent to output devices which cannot support ANSI...