Netgate pfSense CE 跨站脚本漏洞

Netgate pfSense CE is a free and open source FreeBSD-based firewall and router software. Netgate pfSense suffers from a cross-site scripting vulnerability that originates from a network system or product that does not properly filter specific elements of externally entered data during the...

The vulnerability of the Object.h component in the Poppler PDF rendering library, related to a lack of flow control implementation, allows attackers to cause service failures.

The vulnerability of the Object.h component in the Poppler PDF rendering library is related to a lack of implementation for flow control. Exploiting this vulnerability allows an attacker to cause service failures...

Exploit for CVE-2021-1675

From Lares Labs: Detection & Remedia...

CVE-2021-20107

There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low...

Information disclosure

There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low...

CVE-2021-20107

There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low...

CVE-2021-20107

CVE-2021-20107 describes an unauthenticated BLE interface present in Sloan SmartFaucets (including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers such as SOLIS). The vulnerability allows reading and writing to many BLE characteristics over Bluetooth Low Energy, enabling kinetic effects a...

GSD-2021-1001037 RDMA: Verify port when creating flow rule

RDMA: Verify port when creating flow rule This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.11 by commit...

UVI-2021-1001037 RDMA: Verify port when creating flow rule

RDMA: Verify port when creating flow rule This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.11 by commit...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.0 <=1.0.0.RC4), com.dorkbox.GradleVaadin:com.dorkbox.GradleVaadin.gradle.plugin (>=0.1 <=14.1.4) +252 more potentially affected by CVE-2021-33604 via com.vaadin:flow-server (>=2.0.0 <=2.6.1)

com.vaadin:flow-server MAVEN version =2.0.0, =1.0.0, =0.1, =1.4.0, =1.0, =0.0.1, =14.0.0, =14.0.0, =0.0.3, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =0.5.1, =2.0.1, =2.2.3 and more Source cves: CVE-2021-33604 Source advisory: OSV:GHSA-8VFW-V2JV-9HWC...

com.beirtipol:jfixtools-reporting (=1.0-BETA), com.beirtipol:jfixtools-ui-vaadin (=1.0-BETA) +109 more potentially affected by CVE-2021-33604 via com.vaadin:flow-server (>=3.0.0 <=6.0.1)

com.vaadin:flow-server MAVEN version =3.0.0, =1.1.6, =15.0.0, =15.0.0, =0.17.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.0.0, =6.0.1 and more Source cves: CVE-2021-33604 Source advisory: OSV:GHSA-8VFW-V2JV-9HWC...

Zenly: Account Takeover via SMS Authentication Flow

Summary: During the authentication flow, an SMS is sent to the user in order to validate the session and proceed to the user account. The way Zenly API handles this flow is by: 1. Calling the /SessionCreate endpoint with the mobile phone number of the user. 2. A session for the user is created an...

CVE-2021-1073

NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the same time, any other web page is loaded in other tabs of the same browser. In this situation, the web page can get access to the token of...

CVE-2021-1073

NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the same time, any other web page is loaded in other tabs of the same browser. In this situation, the web page can get access to the token of...

CVE-2021-1073

NVIDIA GeForce Experience (Windows) before version 3.23 is affected by CVE-2021-1073. The flaw occurs in the login flow when a user logs in via a browser while another browser tab is loading a page, allowing the page to access the user’s login token and potentially compromise the account. The iss...

Information Disclosure

flow-server is vulnerable to information disclosure. Lack of validation and sanitization of path in the default RouteNotFoundError view allows an attacker to enumerate available routes via malicious HTTP requests...

Remote Code Execution (RCE)

flow-server is vulnerable to remote code execution. The vulnerability exists due to a the system not escaping the " character when passing request via DevModeHandlerImpl...

SQL Injection Vulnerability in Aifei Flow Control Routing of AllConvergence Network Technology (Beijing) Co.

Ltd. was founded in 2013. iKuai is the brand of our products and iKuic is the brand of our overseas products. Ltd. iKuai flow control routing has a SQL injection vulnerability, which can be exploited by attackers to log into the system and obtain sensitive information...

CVE-2021-33604

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 Vaadin 14.0.0 through 14.6.1, 3.0.0 through 6.0.9 Vaadin 15.0.0 through 19.0.8 allows local user to execute arbitrary JavaScript code by opening crafted URL in browser...

CVE-2021-31412

The CVE-2021-31412 entry describes an information-disclosure issue in Vaadin Flow Server’s default RouteNotFoundError view. The vulnerability arises from improper sanitization of the path, enabling a network attacker to enumerate all available routes when the application runs in production mode a...