CVE-2021-0682

In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product:...

UBUNTU-CVE-2021-39891

In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure...

SQL Injection in yeswiki/yeswiki

Description A SQL injection attack consists of insertion or 'injection' of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data Insert/Update/Delete, execute administration operations ...

The vulnerability of the copy_from_user() function in the file system of the shiftfs filesystem in Linux’s operating system, which is related to the repeated release of memory, allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the copyfromuser function in the file system of the shiftfs filesystem in Linux’s operating system is related to the repeated release of memory. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service...

CVE-2021-24465

The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode available for users as low as Contributor before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned...

CVE-2021-24465

The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode available for users as low as Contributor before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned...

Sql injection

The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode available for users as low as Contributor before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned...

CVE-2021-24465

The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode available for users as low as Contributor before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned...

CVE-2021-24465 Meow Gallery < 4.1.9 - Contributor+ SQL Injection

The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode available for users as low as Contributor before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned...

PT-2021-5213 · Huawei · Huawei Smartphone

Name of the Vulnerable Software and Affected Versions: Huawei Smartphone affected versions not specified Description: The issue is related to insufficient input validation, which may allow a remote attacker to disclose protected information or cause a denial of service. Successful exploitation of...

The vulnerability of the monitoring tool for virtual infrastructure vRealize Operations, a platform for virtualization at VMware Cloud Foundation, and the application lifecycle management software vRealize Suite Lifecycle Manager lies in insufficient validation of incoming requests, allowing attackers to disclose sensitive information.

The vulnerability of the monitoring tool for the virtual infrastructure vRealize Operations, the VMware Cloud Foundation virtualization platform, and the vRealize Suite Lifecycle Manager software management tool is related to insufficient checking of incoming requests. Exploiting this vulnerabili...

The vulnerability of the Apache Jena semantic network platform, related to incorrect restrictions on XML links to external objects, allows attackers to disclose protected information.

The vulnerability of the Apache Jena semantic network platform is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose protected information...

Mediatek 芯片 安全漏洞

Mediatek chips are smartphone chipsets from China's MediaTek Mediatek. A security vulnerability exists in the Mediatek chip, which originates in the memory management driver and could lead to information disclosure due to a loss of boundary checks. This could result in the disclosure of local...

Debian DLA-2766-1 : openssl - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2766 advisory. - ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer length...

IBM Security Verify Bridge Information Disclosure Vulnerability (CNVD-2021-77468)

IBM Security Verify Bridge is an IBM application component from International Business Machines IBM, Inc. provides IBM Cloud access to user attributes and authentication that are controlled by the client's local LDAP or Active Directory. A security vulnerability exists in IBM Security Verify Brid...

AZL-6305 CVE-2021-3583 affecting package ansible for versions less than 2.12.1-1

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters...

UBUNTU-CVE-2021-3583

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters...

CVE-2021-3583

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters...

Security Bulletin: Multiple security vulnerabilities have been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component (ISVG IMVA)

Summary IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2015-5262 DESCRIPTION: Apache Commons is vulnerable to a denial of service, caused by the failure to apply a configured connection...

mysql: InnoDB unspecified vulnerability (CPU Jan 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server...