CVE-2021-0973

CVE-2021-0973 affects Android 12 and involves a flaw in isFileUri in UriUtil.java that allows bypassing the ignoring of file:// URIs due to improper case-sensitive handling. The issue can lead to local information disclosure with no additional privileges required, and exploitation requires user i...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Case Manager (CVE-2021-38951)

Summary IBM WebSphere Application Server is shipped as a component of IBM Case Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Possibility to drain TwabRewards smart contract tokens (even with valid ticket)

Handle kemmio Vulnerability details Impact Possibility to drain all smart contract assets abusing uint256 overflow in updateClaimedEpoch Proof of Concept The vulnerability arises because of uint256 overflow in updateClaimedEpoch return userClaimedEpochs | uint2561 The attacker needs to have in...

Can drain any promotion rewards

Handle gzeon Vulnerability details Impact There are no checks to make sure epochId const promotionId = 1; const wallet2Amount = toWei'750'; const wallet3Amount = toWei'250'; await ticket.mintwallet2.address, wallet2Amount; await ticket.connectwallet2.delegatewallet2.address; await...

PUB-A-197328178

In isFileUri of UriUtil.java, there is a possible way to bypass ignoring file://URI attachment due to improper handling of case sensitivity. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2021-44201

creationtimestamp| type| source ---|---|--- 2021-11-29 22:33:38+00:00| seen| https://t.me/cibsecurity/33060...

CVE-2021-33087

creationtimestamp| type| source ---|---|--- 2021-11-17 22:14:52+00:00| seen| https://t.me/cibsecurity/32547...

EulerOS Virtualization 2.9.1 : curl (EulerOS-SA-2021-2751)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the...

CVE-2021-43278

creationtimestamp| type| source ---|---|--- 2021-11-15 00:11:32+00:00| seen| https://t.me/cibsecurity/32381...

CVE-2021-31848

Cross site scripting XSS vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the...

CVE-2021-31848

Cross site scripting XSS vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the...

Cross site scripting

Cross site scripting XSS vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the...

CVE-2021-31848 Data Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)

Cross site scripting XSS vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the...

PT-2021-4998 · Mcafee · Mcafee Data Loss Prevention (Dlp) Epo Extension

Name of the Vulnerable Software and Affected Versions: McAfee Data Loss Prevention ePO extension versions prior to 11.7.100 Description: The issue is related to a lack of protection for the web page structure, allowing for cross-site scripting XSS attacks. This can enable a remote attacker to...

CLSA-2021-1635459168 Fix CVE(s): CVE-2021-22924

SECURITY UPDATE: fix connection reuse checks - debian/patches/CVE-2021-22924.patch: fix connection reuse checks - for issuer cert and case sensitivity in lib/vtls/vtls.c - CVE-2021-22924...

We’re Excited to Announce the Launch of Comms Hub!

We are excited to announce the launch of Comms Hub to the Researcher Portal submission experience! With this launch, security researchers will be able to streamline communication with MSRC case SPMs case managers, attach additional files, track case and bug bounty status all in the Researcher...

We’re Excited to Announce the Launch of Comms Hub!

We are excited to announce the launch of Comms Hub to the Researcher Portal submission experience! With this launch, security researchers will be able to streamline communication with MSRC case SPMs case managers, attach additional files, track case and bug bounty status all in the Researcher...

We’re Excited to Announce the Launch of Comms Hub!

We are excited to announce the launch of Comms Hub to the Researcher Portal submission experience! With this launch, security researchers will be able to streamline communication with MSRC case SPMs case managers, attach additional files, track case and bug bounty status all in the Researcher...

CVE-2021-42764

creationtimestamp| type| source ---|---|--- 2021-10-21 00:35:45+00:00| seen| https://t.me/cibsecurity/30927...

UserManager: updateLockedData() locks more amount than required.

Handle itsmeSTYJ Vulnerability details Impact The function updateLockedData calls creditLimitModel.getLockedAmount which is executed in a for loop with amount passed as an argument. This means that all stakers that are staking on behalf of the borrower are asked to lock amount . If I wanted to lo...