CVE-2021-37215

The CVE-2021-37215 entry describes an Insecure Direct Object Reference (IDOR) in Flygo’s employee management page. After authenticating as a general user, an attacker can manipulate and overwrite another employee’s data by supplying that employee’s ID in an API parameter. Documents confirm this v...

CVE-2021-37214

CVE-2021-37214 affects Flygo's employee management page. It is an Insecure Direct Object Reference (IDOR ) vulnerability allowing an authenticated general user to alter the employee ID parameter to access/modify other employees’ data, escalate to administrator privileges, and execute arbitrary co...

CVE-2021-38159

In certain Progress MOVEit Transfer versions before 2021.0.4 aka 13.0.4, SQL injection in the MOVEit Transfer web application could allow an unauthenticated remote attacker to gain access to the database. Depending on the database engine being used MySQL, Microsoft SQL Server, or Azure SQL, an...

Vulnerabilities fixed in Foxit Reader

Vulnerabilities have been fixed in Foxit PDF Reader and PDF Editor. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Data manipulation. Remote code execution User Rights To exploit these...

Nasty Windows Printer Driver Vulnerability

From SentinelLabs, a critical vulnerability in HP printer drivers: Researchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers also used by Samsung and Xerox, which impacts hundreds of millions of Windows machines. If exploited, cyberattackers...

Oracle VM VirtualBox Unauthorized Access Vulnerability (CNVD-2021-54712)

Oracle VM VirtualBox is a cross-platform virtualization software for x86 systems. A security vulnerability exists in the Core component of Oracle VM VirtualBox versions prior to 6.1.24. An attacker could use this vulnerability to gain unauthorized read access to a portion of the product-accessibl...

Vulnerabilities fixed in NVIDIA GPU Display Driver

Vulnerabilities have been fixed in NVIDIA GPU Display Driver. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Manipulation of data Access to system data Increased user privileges NVIDIA has...

Design/Logic Flaw

Vulnerability in the Oracle Field Service product of Oracle E-Business Suite component: Wireless. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Field Service. Successful...

CVE-2021-2455

Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft component: Person Search. The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

Vulnerabilities fixed in Oracle Peoplesoft products

Oracle has fixed vulnerabilities in PeopleSoft Enterprise HCM Candidate Gateway, PeopleSoft Enterprise PT PeopleTools, PeopleSoft Enterprise CS Campus Community and PeopleSoft Enterprise HCM Shared Components. The vulnerabilities potentially enable a malicious party to able to perform attacks tha...

Vulnerabilities fixed in Oracle Siebel Suite

Oracle has fixed vulnerabilities in Siebel CRM and Siebel Apps. The vulnerabilities potentially enable a malicious party to execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User rights Access to sensitive data Acce...

Vulnerabilities fixed in Oracle MySQL

Oracle has fixed vulnerabilities in the following Oracle MySQL products: MySQL Connectors MySQL Server MySQL Enterprise Monitor The vulnerabilities allow an unauthenticated malicious person with network access to the vulnerable system may be able to launch attacks execute attacks that result in t...

CVE-2021-2436

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite component: CRM User Management Framework. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2021-2417

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: GIS. Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

CVE-2021-2375

CVE-2021-2375 affects Oracle JD Edwards EnterpriseOne Tools (Web Runtime) up to and including version 9.2.5.3. An unauthenticated attacker with network access via HTTP can compromise JD Edwards EnterpriseOne Tools; attacks require user interaction. Consequences include unauthorized update/insert/...

CVE-2021-2363

CVE-2021-2363 affects Oracle E-Business Suite’s Oracle Public Sector Financials (International) with the Authorization vulnerability in versions 12.1.1–12.1.3. The underlying issue enables a low-privilege, network-accessing attacker (HTTP) to perform unauthorized creates, deletes, or modification...

CVE-2021-2338

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM component: Email Marketing Stand-Alone. Supported versions that are affected are 21.5 and Prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps -...

CVE-2021-2324

Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications component: Loans And Deposits. Supported versions that are affected are 12.0-12.4, 14.0-14.4 and . Easily exploitable vulnerability allows low privileged attacker with network access via HTTP ...

Vulnerabilities fixed in Aruba AOS-CX switches

Vulnerabilities have been fixed in Aruba AOS-CX switches. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Manipulation of data. Bypassing authentication Remote code execution Administrator/Root privileges The...

Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr

✍️ Description Attacker can delete any Product for any user with CSRF vulnerability when the Admin or SuperAdmin or an authorized user click on PoC.html file, it is enough to attacker know the Product id on server. I convert the GET...