Deserialization of untrusted data

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution RCE via a maliciously crafted Java deserialization gadget chain leveraged against the Ratpack session store. If one's application does not use Ratpack's session...

CVE-2021-20103

Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with forms through upload.php...

CVE-2021-20103

Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with forms through upload.php...

kexec-tools bug fix and enhancement update

The kexec-tools packages contain the /sbin/kexec binary and utilities that together form the user-space component of the kernel's kexec feature. The /sbin/kexec binary facilitates a new kernel to boot using the kernel's kexec feature either on a normal or a panic reboot. The kexec fastboot...

The vulnerability of the sshd service in the OpenSSH encryption protection mechanism allows a hacker to induce a service failure.

The vulnerability of the sshd service in the OpenSSH encryption protection mechanism is related to deficiencies in access control for certain functions. Exploiting this vulnerability could allow an attacker to cause a service failure...

Zhengzhou Weixia Computer Technology Co., Ltd. learning platform has a logic flaw vulnerability

Zhengzhou Weixia Computer Technology Co., Ltd. is a company mainly engaged in the development of online education software. Zhengzhou Weixia Computer Technology Co., Ltd. learning platform has a logic flaw vulnerability that can be exploited by attackers to bypass the authentication mechanism to...

PT-2021-3459 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue is related to security mechanism shortcomings in Microsoft Edge, allowing a remote attacker to potentially elevate their privileges. Recommendations: At the...

CVE-2021-28815

Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link...

Code injection

Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link...

XScreenSaver buffer overflow vulnerability

XScreenSaver is an open source screensaver written in C. XScreenSaver suffers from a buffer error vulnerability that stems from updatescreenlayout causing a buffer overflow when the application has more than 10 disconnectable video outputs. An attacker could bypass the authentication mechanism...

CVE-2021-31840 DLL preload vulnerability in McAfee Agent for Windows

A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local attacker to perform a DLL preloading attack with unsigned DLLs. To exploit this vulnerability, the attacker would need to have valid...

CVE-2021-31840

CVE-2021-31840 affects McAfee Agent for Windows prior to 5.7.3, where the DLL preloading mechanism allows a local, authenticated attacker to load unsigned DLLs, gain elevated privileges, and execute arbitrary code. The issue is tied to the preloading path of specific DLLs within McAfee Agent; Red...

CVE-2020-24515

Protection mechanism failure in some IntelR RealSenseTM IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

Session fixation

Protection mechanism failure in some IntelR RealSenseTM IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

Session fixation

Protection mechanism failure in some IntelR ThunderboltTM controllers may allow an authenticated user to potentially enable denial of service via local access...

CVE-2020-24515

CVE-2020-24515 affects Intel RealSense ID (F450/F455). Root cause: protection mechanism failure in some RealSense IDs enabling privilege escalation by an unauthenticated user with physical access. Impact: escalation of privileges; attacker requires physical access; CVSSv3.1 vector AV:P/AC:H/PR:N/...

CVE-2020-24515

Protection mechanism failure in some IntelR RealSenseTM IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

Intel RealSense IDs 安全漏洞

Intel RealSense IDs is a real-sense technology from Intel Corporation USA. The most comprehensive computer vision hardware and software solution for making your products understand the 3D world. A security vulnerability exists in IntelR RealSenseTM IDs that stems from a protection mechanism failu...

CVE-2021-32674 Remote Code Execution via traversal in TAL expressions

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL...

Intel Thunderbolt controller 安全漏洞

The Intel Thunderbolt controller is a connector standard published by Intel, a U.S.-based company that supports both copper and fiber-optic media and is intended to be used as a common bus between computers and other devices. A security vulnerability exists in the IntelR ThunderboltTM controller,...