CVE-2021-22000

VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative privileges may exploit this vulnerability to elevate privileges to administrator level on the Windows operating system having VMware ThinApp...

CVE-2021-32710

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older version...

Imcat SQL注入漏洞

imcat intimate cat is a lightweight, free, shared general-purpose PHP web application. A SQL injection vulnerability exists in imcat version 5.2. An attacker can exploit this vulnerability by using the fmauser parameter in coms/addcoms.php to perform a SQL injection attack...

DEBIAN-CVE-2009-0948

Multiple buffer overflows in the 1 cdfreadsat, 2 cdfreadlongsectorchain, and 3 cdfreadssat function in file before 5.02...

PT-2021-3400 · Unknown · Spring Framework

Name of the Vulnerable Software and Affected Versions: Spring Framework versions 5.2.x prior to 5.2.15 Spring Framework versions 5.3.x prior to 5.3.7 Description: The issue is caused by privilege management errors in the Spring Framework platform. Exploitation of this issue may allow an attacker ...

Plone 跨站脚本漏洞

Plone is a foreign open source CMS system suitable for enterprise-level applications. A cross-site scripting vulnerability exists in the user full name attribute and file upload functionality in Plone CMS versions prior to 5.2.4. The vulnerability stems from user input that is not properly encode...

CVE-2021-32453

SITEL CAP/PRX firmware version 5.2.01 allows an attacker with access to the local network, to access via HTTP to the internal configuration database of the device without any authentication. An attacker could exploit this vulnerability in order to obtain information about the device´s configurati...

PT-2021-19705 · Sitel · Sitel Cap/Prx

Name of the Vulnerable Software and Affected Versions: SITEL CAP/PRX firmware version 5.2.01 Description: The issue allows an attacker with access to the local network to access the internal configuration database of the device via HTTP without any authentication. This could be exploited to obtai...

Sitel CAP/PRX 资源管理错误漏洞

Sitel CAP/PRX is an operating system from Sitel France. It is used for central processing units that have a 180MHz ARM9 architecture. A resource management error vulnerability exists in SITEL CAP/PRX firmware version 5.2.01, which could be exploited by an attacker to cause a denial of service...

CVE-2021-32918

An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service DoS attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3...

CVE-2020-18084

Cross Site Scripting XSS in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in...

CVE-2021-3038

A denial-of-service DoS vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death BSOD error. This issue impacts: GlobalProtect app 5.1 versions...

GHSA-6G3C-2MH5-7Q6X Missing validation of JWT signature in `ManyDesigns/Portofino`

Impact Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. Patches The issue will be patched in the upcoming 5.2.1 release. For more information If you have any questions o...

Alessio Stalla Portofino 数据伪造问题漏洞

Alessio Stalla Portofino is an Alessio Stalla open source application. A low-code tool for building model-driven REST APIs and web applications. A security vulnerability exists in Portofino version 5.2.1, which stems from . Portofino is an open source web development framework. Prior to version...

Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 8.1, RT 8.1, and Windows Server 2012 R2 (KB5001881)

Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 8.1, RT 8.1, and Windows Server 2012 R2 KB5001881 Applies to: Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1...

CVE-2021-27887

Cross-site Scripting XSS vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids Ellipse APM 5.3...

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.

...

Revive Adserver 跨站脚本漏洞

Revive Adserver is an open source ad server under the GNU General Public License license with an integrated banner management interface and a tracking system for collecting statistical information. A reflected cross-site scripting vulnerability exists in the status parameter in...

CVE-2021-1492

The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Duo...

DEBIAN-CVE-2021-3409

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resultin...