13508 matches found
DRUPAL-CONTRIB-2021-030
This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters. The module doesn't sufficiently invalidate page output when the page\cache module is used. This vulnerability is mitigated by t...
Oracle Linux 8 : curl (ELSA-2021-3582)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3582 advisory. - fix bad connection reuse due to flawed path name checks CVE-2021-22924 Tenable has extracted the preceding description block directly from the Oracle...
Gurock Software Gurock TestRail 信息泄露漏洞
Gurock Software Gurock TestRail is a web-based test case management software for QA and development teams from Gurock Software. The software supports the creation of test cases, the management of test suites and the coordination of the testing process. Gurock Software An information disclosure...
User hash - Moderately critical - Cache poisoning - SA-CONTRIB-2021-030
This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters. The module doesn't sufficiently invalidate page output when the pagecache module is used. This vulnerability is mitigated by th...
curl: Content not matching hash in Metalink is not being discarded
A flaw was found in curl in the way curl handles a file hash mismatch after downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to trick users into downloading malicious content. The highest threat from this vulnerability is to integrity...
curl security update
An update is available for curl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...
UBUNTU-CVE-2021-39579
An issue was discovered in swftools through 20200710. A heap-buffer-overflow exists in the function stringhash located in q.c. It allows an attacker to cause code Execution...
CVE-2021-39579
An issue was discovered in swftools through 20200710. A heap-buffer-overflow exists in the function stringhash located in q.c. It allows an attacker to cause code Execution...
CVE-2021-39584
An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function namespacesethash located in pool.c. It allows an attacker to cause Denial of Service...
UBUNTU-CVE-2021-39584
An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function namespacesethash located in pool.c. It allows an attacker to cause Denial of Service...
OESA-2021-1343 libssh security update
The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote...
Ntlm_Theft - A Tool For Generating Multiple Types Of NTLMv2 Hash Theft Files
A tool for generating multiple types of NTLMv2 hash theft files. ntlmtheft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already inside the...
Reddit: Hash-Collision Denial-of-Service Vulnerability in Markdown Parser
Summary: We have found three bugs in Reddit's markdown parser. Two of these bugs are exploitable to launch an algorithmic complexity denial-of-service DoS attack. In this report we explain the bugs and exploits. We also show, in a non-disruptive way, that it appears to exist in the current versio...
cyrus-imapd: Denial of service via string hashing algorithm collisions
A flaw was found in cyrus-imapd. A bad string hashing algorithm used in internal hash tables allows user inputs to be stored in predictable buckets. A user may cause a CPU denial of service by maliciously directing many inputs to a single bucket. The highest threat from this vulnerability is to...
Cross-site Scripting (XSS) - DOM in zoujingli/thinkadmin
Description DOM based xss via url hash frgament Proof of Concept First login into https://v6.thinkadmin.top and then visit https://v6.thinkadmin.top/admin.htmlhttps://bbounty.000webhostapp.com/cors.php?id=xxxxx2 and see xss is executed Impact DOM based xss via url hash fragment...
Description of the security update for Office 2013: September 14, 2021 (KB5001958)
Description of the security update for Office 2013: September 14, 2021 KB5001958 Summary This security update resolves a Microsoft Office Access connectivity engine remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures...
Description of the security update for Office Web Apps Server 2013: September 14, 2021 (KB5002009)
None None...
Description of the security update for Office 2016: September 14, 2021 (KB4484103)
None None...
Description of the security update for Office Online Server: September 14, 2021 (KB5001999)
None None...
Description of the security update for Office 2013: September 14, 2021 (KB5002007)
Description of the security update for Office 2013: September 14, 2021 KB5002007 Summary This security update resolves Microsoft Office graphics remote code execution vulnerabilities. To learn more about the vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2021-38658 and...