CVE-2020-11197

Possible integer overflow can occur when stream info update is called when total number of streams detected are zero while parsing TS clip with invalid data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,...

Chromium CVE-2021-21134: Incorrect security UI in Page Info

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Google Chrome 安全漏洞

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. An incorrect security UI vulnerability exists in Page Info in versions of Google Chrome prior to 88.0.4324.96. An attacker can exploit this vulnerability to spoof t...

Exploit for Out-of-bounds Write in Php

This is an exploit for a bug in php-fpm CVE-2019-11043. The bug is possible to trigger from the outside in certain nginx + php-fpm configurations, allowing a web user to execute code if the configuration is vulnerable. The exploit works by setting the PHPVALUE path info to a malicious value, whic...

CVE-2020-26414

creationtimestamp| type| source ---|---|--- 2021-01-15 18:51:11+00:00| seen| https://t.me/cibsecurity/22215...

PT-2021-14883 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.8 and later Description: A regular expression denial of service issue has been discovered in the NuGet API. Recommendations: For GitLab versions 12.8 and later, at the moment, there is no information about a newer version...

PT-2021-11240 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.4 and later Description: An issue has been discovered in GitLab where the regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string...

PT-2021-14882 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.1 and later Description: An issue has been discovered in GitLab where incorrect headers in specific project pages allow an attacker to have temporary read access to private repositories. Recommendations: For GitLab versions...

Information disclosure

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...

CVE-2020-29017

creationtimestamp| type| source ---|---|--- 2021-01-14 18:49:46+00:00| seen| https://t.me/cibsecurity/22164...

Insecure Permissions

ceph-ansible is vulnerable to insecure permission. The vulnerability allows any user to read sensitive information within...

Cross site scripting

Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack and obtain potentially confidential information by leveraging a flaw in the authentication mechanism. For more information...

CVE-2021-1697

creationtimestamp| type| source ---|---|--- 2021-01-12 22:54:43+00:00| seen| https://t.me/cibsecurity/21996...

CVE-2021-1663

Windows Projected File System FS Filter Driver Information Disclosure Vulnerability...

CVE-2021-1637

Technical details for CVE-2021-1637 are not publicly provided in the connected documents. Monitor official advisories for updates.

CVE-2021-21448

SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on th...

Authorization

SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on th...

January 12, 2021 Servicing Stack Update (KB4599118)

None None...

PT-2021-11068 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.4 and earlier Description: The issue allows for XSS via the app loading mechanism, specifically through the PATH INFO to the "/appsuite" URI. Recommendations: For OX App Suite versions 7.10.4 and earlier, update to ...

CVE-2021-0309

In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. This could lead to local information disclosure and account access with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.1, Android-9,...