A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

...

Oracle MySQL 输入验证错误漏洞

Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Connectors is a driver for applications that use MySQL. versions 8.0.27 and earlier are vulnerable to an input validation error. An attacker could use this vulnerability to compromise Oracle MySQL...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. An access control error vulnerability exists in Mattermost versions 6.1 and earlier, which stems from a network system or product that does not properly restrict access to resources from unauthorized roles, and could be...

CVE-2021-20612

Lack of administrator control over security vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.14 and prior, FX3U-ENET-L Firmware version 1.14 and prior and FX3U-ENET-P502 Firmware version 1.14 and prior allows a remote unauthenticated attacker to cause a denial-of-service DoS conditio...

Jenkins Plugin 跨站请求伪造漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Publish Over SSH Plugin in version 1.22 and earlier contains a cross-site request forgery vulnerability that stems...

UBUNTU-CVE-2022-21664

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected...

CVE-2021-43985

An unauthenticated remote attacker can access mySCADA myPRO Versions 8.20.0 and prior without any form of authentication or authorization...

CVE-2021-20049

A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions...

CVE-2021-44453

mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow an attacker to inject arbitrary operating system commands...

PT-2021-24065

Name of the Vulnerable Software and Affected Versions: Acclaim USAHERDS versions 7.4.0.1 and earlier Description: The issue concerns the use of hard-coded credentials in Acclaim USAHERDS, allowing attackers to bypass authentication and gain unauthorized access to sensitive systems and data. This...

Dell Wyse Device Agent 信息泄露漏洞

Wyse Device Agent WDA is a unified agent for all thin and light client management solutions.An information disclosure vulnerability exists in Wyse Device Agent 14.5.4.1 and prior versions. A local attacker could use this vulnerability to access sensitive information...

CVE-2021-43021

Adobe Premiere Rush version 1.5.16 and earlier is affected by a memory corruption vulnerability due to insecure handling of a malicious EXR file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

...

ksmbd 安全漏洞

ksmbd is an open source kernel CIFS/SMB3 server created by Namjae Jeon for the Linux kernel. It is an implementation of the SMB/CIFS protocol in kernel space for sharing files and IPC services over a network. A security vulnerability exists in ksmbd server 3.4.2 and earlier versions, which result...

PT-2021-5985 · Adobe · After Effects

Name of the Vulnerable Software and Affected Versions: Adobe After Effects versions 22.0 and earlier Adobe After Effects versions 18.4.2 and earlier Description: The issue is related to an out-of-bounds read vulnerability in Adobe After Effects, which could lead to disclosure of sensitive memory...

Mozilla: Denial of Service when using the Location API in a loop

Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

Fortinet Meru AP 操作系统命令注入漏洞

Fortinet Meru Ap is a wireless access point from Fortinet, Inc. Fortinet Meru AP is vulnerable to code injection in versions 8.6.1 and 8.5.5 and below. The vulnerability stems from a failure of the network system or product to properly filter special elements in code segments constructed from...

Samsung SMR 路径遍历漏洞

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in versions prior to Samsung SMR Dec-2021 Release 1, which can be exploited by an attacker to write arbitrary files via a path traversal vulnerabili...

Adobe Bridge 缓冲区错误漏洞

Adobe Bridge is a file viewer from Adobe. 11.1.1 and earlier versions of Adobe Bridge contain an out-of-bounds read vulnerability. An attacker could exploit this vulnerability to cause a memory leak...