CVE-2021-39870

In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call...

PT-2021-23097 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 11.5.0 Description: A cross-site request forgery issue has been discovered in the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface. This issue can be exploited withou...

UBUNTU-CVE-2021-39874

In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands...

PT-2021-23439 · Suitecrm · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions 7.10.x through 7.10.32 SuiteCRM versions 7.11.x through 7.11.21 Description: The issue allows for privilege escalation. Recommendations: For SuiteCRM versions 7.10.x through 7.10.32, update to version 7.10.33 or later. For...

PT-2021-22721 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.0 and later Description: The requirement to enforce 2-factor authentication 2FA is not honored when using git commands in the affected versions. Recommendations: For GitLab CE/EE versions 11.0 and later, consider...

SuiteCRM 安全漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM Suitecrm team. A security vulnerability in SuiteCRM 7.10.x prior to 7.10.33 and 7.11.x prior to 7.11.22 exists that allows an attacker to perform elevation of privilege...

CVE-2021-39819

Adobe InCopy version 11.1 and earlier is affected by a memory corruption vulnerability due to insecure handling of a malicious XML file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability...

Mediatek 芯片 缓冲区错误漏洞

Mediatek chips are smartphone chipsets from China's MediaTek Mediatek. A security vulnerability exists in Mediatek chips, which stems from a lack of boundary checking in the memory management driver, which could result in a local elevation of privilege that requires system execution privileges. T...

Mediatek 芯片 资源管理错误漏洞

Mediatek chips are smartphone chipsets from China's MediaTek Mediatek. A security vulnerability exists in the Mediatek chips, which stems from a possible memory corruption due to the use of m4u after its release, which could result in a local elevation of privilege that requires system execution...

Mediatek 芯片 资源管理错误漏洞

Mediatek chips are smartphone chipsets from China's MediaTek Mediatek. A security vulnerability exists in the Mediatek chips, which stems from a possible memory corruption due to the use of m4u after its release, which could result in a local elevation of privilege that requires system execution...

Mediatek 芯片 输入验证错误漏洞

Mediatek chips are smartphone chipsets from China's MediaTek Mediatek. A security vulnerability exists in the Mediatek chips, which stems from an integer overflow in the memory management driver that could lead to memory corruption, which could result in a local elevation of privilege that requir...

Mediatek 芯片 缓冲区错误漏洞

The Mediatek chip is a smartphone chipset from China's MediaTek Mediatek. A security vulnerability exists in the Mediatek chip that stems from incorrect ccu error handling, which may result in an out-of-bounds read. This could lead to the disclosure of information that requires system execution...

Mediatek 芯片 安全漏洞

Mediatek chips are smartphone chipsets from China's MediaTek Mediatek. A security vulnerability exists in the Mediatek chipset, which is caused by uninitialized data from the memory management driver, which could lead to an information disclosure that could result in a local elevation of privileg...

IBM Security Guardium 信息泄露漏洞

IBM Security Guardium is a comprehensive data protection solution that provides full data security capabilities from compliance support to dynamic data masking. an information disclosure vulnerability exists in IBM Security Guardium version 11.3. An attacker could exploit the vulnerability to...

PT-2021-6072 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 5.10 through 5.14.6 Description: The issue is related to a buffer overflow in the loop rw iter function in the Linux kernel's io uring subsystem, allowing local users to gain privileges. This is due to an error in the...

CVE-2021-40066

The access controls on the Mobility read-only API improperly validate user access permissions. Attackers with both network access to the API and valid credentials can read data from it; regardless of access control group membership settings. This vulnerability is fixed in Mobility v11.76 and...

CVE-2021-33690

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...

CVE-2021-20508

IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199322...

IBM Security Secret Server 信息泄露漏洞

IBM Security Secret Server is a privileged access management solution from IBM Corporation. The product supports password management, privileged account identification, and privileged session access monitoring logs.IBM Security Secret Server 11.0 previously had a security vulnerability that stemm...

CS-Cart 跨站脚本漏洞

CS-Cart is an e-commerce platform developed from the former open source PHP. A cross-site scripting vulnerability exists in CS-Cart version 4.11.1, which stems from the lack of effective validation and escaping of user input in the post description on the blog post creation page in the software,...