CVE-2021-36061

Adobe Connect 11.2.2 and earlier is affected by a secure design principles violation (pbMode) that allows editing/deleting recordings. Exploitation requires a victim to publish a link, and attacker is unauthenticated. Remediation: apply APSB21-66 update to 11.2.3 or later (per sources noting 11.2...

CVE-2021-36061 Adobe Connect Violation of Secure Design Principles Vulnerability Can Lead To Editing Or Deleting Recordings

Adobe Connect version 11.2.2 and earlier is affected by a secure design principles violation vulnerability via the 'pbMode' parameter. An unauthenticated attacker could leverage this vulnerability to edit or delete recordings on the Connect environment. Exploitation of this issue requires user...

Design/Logic Flaw

Samsung Drive Manager 2.0.104 on Samsung H3 devices allows attackers to bypass intended access controls on disk management. WideCharToMultiByte, WideCharStr, and MultiByteStr can contribute to password exposure...

CVE-2021-36061: Violation of Secure Design Principles

Adobe Connect version 11.2.2 and earlier is affected by a secure design principles violation vulnerability via the 'pbMode' parameter. An unauthenticated attacker could leverage this vulnerability to edit or delete recordings on the Connect environment. Exploitation of this issue requires user...

Design/Logic Flaw

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript...

Design/Logic Flaw

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's...

Design/Logic Flaw

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once...

Design/Logic Flaw

gitconnectgit in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring...

NPM Arborist: Postback link vulnerability

NPM arborist is a software package from the American company npm NPM. It is used to visualize hierarchical data stored as flat lists. NPM arborist suffers from a backlink vulnerability that originates from an improperly designed or implemented code development process for a networked system or...

Design/Logic Flaw

libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase. When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service...

Design/Logic Flaw

An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files...

Design/Logic Flaw

Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Design/Logic Flaw

EmTec ZOC before 8.02.2 allows \e201 pastes, a different vulnerability than CVE-2021-32198...

Design/Logic Flaw

Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs do not enforce access controls, allowing an unauthenticated threat actor to access privileged functionality, leading to OS command execution. The specific attack methodology is a file upload...

Design/Logic Flaw

Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload...

Design/Logic Flaw

Cscape All Versions prior to 9.90 SP5 lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write via an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process...

Design/Logic Flaw

Cscape All Versions prior to 9.90 SP5 lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute code in the context of the current process...

Design/Logic Flaw

Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group...

Design/Logic Flaw

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 and iPadOS 15.2, watchOS 8.3. A local attacker may be able to elevate their privileges...

Design/Logic Flaw

This issue was addressed with improved checks. This issue is fixed in Security Update 2022-001 Catalina, macOS Big Sur 11.6.3. A malicious application may be able to bypass certain Privacy preferences...