PYSEC-2022-39

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Affected versions of the desktop application were found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing...

PT-2022-13062 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.5 and later Description: An issue has been discovered in GitLab CE/EE, allowing for arbitrary file read by importing a group due to incorrect handling of files. Recommendations: For versions 14.5 and later, update to ...

CVE-2022-22289

Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information...

CVE-2021-42748

In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API...

Samsung S Assistant 授权问题漏洞

Samsung S Assistant is a cell phone application from Samsung South Korea. It provides a cell phone management feature. A security vulnerability exists in S Assistant prior to version 7.5 that allows an attacker to remotely access sensitive information...

DEBIAN-CVE-2021-45935

Grok 9.5.0 has a heap-based buffer overflow in openhtj2k::T1OpenHTJ2K::decompress called from std::1::packagedtaskfuncstd::1::bindgrk::T1DecompressScheduler::deco and std::1::packagedtaskint...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the Smart...

PT-2021-24204 · Knime · Knime Analytics Platform

Name of the Vulnerable Software and Affected Versions: KNIME Analytics Platform versions prior to 4.5.0 Description: The issue concerns an external XML entity injection XXE vulnerability. It can be exploited via a crafted workflow file .knwf. Recommendations: For versions prior to 4.5.0, update t...

Gradio 路径遍历漏洞

Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. versions of Gradio prior to 2.5.0 have a path traversal vulnerability that can be exploited by an attacker to access any file on the host...

CVE-2021-43762

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a dispatcher bypass vulnerability that could be abused to evade security controls. Sensitive areas of the web application may be exposed through exploitation of the vulnerability...

OPENSUSE-SU-2021:3835-1 Security update for mariadb

This update for mariadb fixes the following issues: - Update to 10.5.13: - CVE-2021-35604: Fixed InnoDB vulnerability that allowed an high privileged attacker with network access via multiple protocols to compromise MySQL bsc1192497...

Vulnerabilities fixed in VMware vCenter

VMware has fixed vulnerabilities in vCenter server. A malicious party on the local network, with access to port 443 could exploit the vulnerabilities to gain access to sensitive data. VMware did not release further details. VMWare has released updates to fix the vulnerabilities in vCenter server...

CVE-2021-43019

Adobe Creative Cloud version 5.5 and earlier are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker mu...

CVE-2021-29324

OpenSource Moddable v10.5.0 was discovered to contain a stack overflow via the component /moddable/xs/sources/xsScript.c...

CVE-2021-29329

OpenSource Moddable v10.5.0 was discovered to contain a stack overflow in the fxBinaryExpressionNodeDistribute function at /moddable/xs/sources/xsTree.c...

Atmail 跨站脚本漏洞

AtMail is an open source WebMail client from Atmail Australia, which provides Webmail interface, address book management, calendar and other features, and supports IMAP, video mail, etc. A cross-site scripting vulnerability exists in the WebAdmin control panel of AtMail version 6.5.0. An attacker...

alphapulldown (>=0.21.2 <=0.22.3), analytics-lib (>=0.0.1 <=0.0.2) +60 more potentially affected by CVE-2021-41195 via tensorflow (>=2.5.0 <=2.5.1)

tensorflow PYPI version =2.5.0, =0.21.2, =0.0.1, =1.1.0, =0.1.6, =0.8.1, =3.3.0, =0.0.24, =1.0.0, =2.0.2, =0.6.0, =0.8.0 and more Source cves: CVE-2021-41195 Source advisory: OSV:GHSA-CQ76-MXRC-VCHH...

Philips Mri 3T 访问控制错误漏洞

The Philips Mri 3T is a magnetic resonance system from Philips Netherlands. It is used to help clinicians diagnose with confidence, explore new applications and work efficiently. An access control error vulnerability exists in the Philips MRI 1.5T and 3T, which arises from software that does not...

PYSEC-2021-829

TensorFlow is an open source platform for machine learning. In affected versions the implementation of SplitV can trigger a segfault is an attacker supplies negative arguments. This occurs whenever sizesplits contains more than one value and at least one value is negative. The fix will be include...

PT-2021-22743 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 10.5 and above Description: The issue concerns improper access control, where subgroup members with inherited access to a project from a parent group could still access the project even after the subgroup is transferred...