CVE-2021-21703

php-fpm has a vulnerability which may lead to local privilege escalation. This vulnerability is hard to exploit as the attack needs to escape the FPM sandbox mechanism. When a complete attack is achieved it may lead to risk for confidentiality, data integrity, and system availability...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, and other functions. A security vulnerability exists in the Oracle Deal...

The vulnerability of Mermaid software for generating diagrams and block diagrams lies in the lack of measures taken to protect the structure of web pages, allowing attackers to compromise data integrity.

The vulnerability of Mermaid software for generating diagrams and block diagrams is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a remote attacker to compromise the integrity of data...

The vulnerability of the table_population.php file, a tool for monitoring Nagios XI Docker Wizard, allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tablepopulation.php file of the Nagios XI Docker Wizard tool is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the Drupal CMS system’s kernel, related to the lack of protective measures for website structures, allows attackers to compromise data integrity.

The vulnerability of the Drupal CMS system’s kernel lies in the fact that the AJAX API does not disable JSONP by default. Exploiting this vulnerability allows an attacker to compromise the integrity of data...

The vulnerability of the “pleaseedit” system administration tool is related to an incorrect definition of the link before accessing the file. This allows attackers to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the “pleaseedit” system administration tool is related to the use of predictable file names. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and even cause service interruptions...

The vulnerability of the RSS/Atom/Pie LibGRSS library, related to errors in the authentication process for certificates, allows attackers to compromise the integrity of data.

The vulnerability of the RSS/Atom/Pie LibGRSS library is related to errors in the TLS certificate validation process when loading streams. This occurs due to a standard behavior of the SoupSessionSync library. Exploiting this vulnerability could allow an attacker to compromise the integrity of da...

The vulnerability of the electronic examination system TCExam arises from the lack of measures taken to protect the structure of the web page. This allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the electronic examination system TCExam exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information through a specially...

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2020 are related to memory management after it is released. These vulnerabilities allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, Adobe Acrobat 2020, and Adobe Acrobat Reader 2020 are related to the use of memory after it is released. Exploiting the...

keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity

A flaw was found in keycloak. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity...

nodejs: Incomplete validation of tls rejectUnauthorized parameter

A flaw was found in Node.js. If the Node.js HTTPS API is used incorrectly and "undefined" is passed for the "rejectUnauthorized" parameter, no error is returned, and the connections to servers with an expired certificate are accepted. The highest threat from this vulnerability is to integrity...

PT-2021-6547 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 13.12.9 GitLab CE/EE versions prior to 14.0.7 GitLab CE/EE versions prior to 14.1.2 Description: The issue is related to incorrect session management in GitLab, allowing a remote attacker to impact data integrit...

PT-2021-6499

Name of the Vulnerable Software and Affected Versions datatables.net versions prior to 1.11.3 Description The issue is related to the incorrect handling of an array in the input data by the DataTables plugin, which can allow a remote attacker to compromise data integrity. If an array is passed to...

The vulnerability of Google Chrome’s navigation mechanism, related to improper authorization, allows a perpetrator to compromise data integrity.

The vulnerability of Google Chrome’s navigation function is related to the insufficient implementation of security policies. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

The vulnerability of the mod_auth_digest function in the Apache HTTP Server allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the modauthdigest function in the Apache HTTP Server arises from the execution of operations outside the buffer on the stack. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability in the upload.php PHP form creator of Machform allows a hacker to compromise the confidentiality and integrity of the protected information.

The vulnerability in the upload.php PHP form builder of Machform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

The vulnerability of the ReadXPMImage function in the coders/xpm.c component of the console-based image editing tool ImageMagick allows an attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the ReadXPMImage function in the coders/xpm.c component of the console-based image editing tool ImageMagick involves allowing the operation to be within acceptable buffer data limits. Exploiting this vulnerability allows a remote attacker to gain access to confidential data,...

ruby: XML round-trip vulnerability in REXML

A flaw was found in the way the Ruby REXML library parsed XML documents. Parsing a specially crafted XML document using REXML and writing parsed data back to a new XML document results in creating a document with a different structure. This issue could affect the integrity of processed data in...

jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity XXE attacks. The highest threat from this vulnerability is data integrity...

kernel: SCSI target (LIO) write to any block on ILO backstore

A flaw was found in the Linux kernel’s implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to overwrite data on t...