CVE-2021-36871

Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities in WordPress WP Google Maps Pro premium plugin versions &attributes, Name &attributes, &icons, &names, &description, &link, &title...

qdPM 跨站脚本漏洞

qdPM is a Web-based open source project management tool. A cross-site scripting vulnerability exists in qdPM, which stems from the lack of valid validation of user-side data in the product qdPMinstallmodulesdatabaseconfig.php file. The vulnerability can be exploited to execute client-side code. T...

Arista Networks MOS 安全漏洞

Arista Networks MOS is a fully programmable and highly modular Linux-based network operating system from Arista Networks, Inc. that uses the familiar industry-standard CLI and runs a single binary software image within the Arista switching family. A security vulnerability exists in the Arista...

CVE-2021-3049

An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of. This issue impacts: All Cortex...

CVE-2021-31798

The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious user can obtain the plaintext of cache files...

Cyberark Software CyberArk Credential Provider 安全特征问题漏洞

CyberArk Software Credential Provider is an installation credential provider program from CyberArk Software, Israel. A security feature issue vulnerability exists in CyberArk Credential Provider versions prior to 12.1, which stems from the use of low-level encryption for the valid key space used ...

iPortalis 输入验证错误漏洞

iPortalis is providing management of Microsoft licenses, costs, governance and reporting capabilities. An input validation error vulnerability exists in iPortalis iCS that stems from not adding a valid privilege authentication to a UserRoleKey=request. An attacker could gain domain administrative...

Cyberark Software CyberArk Credential Provider 安全特征问题漏洞

CyberArk Software Credential Provider is an installation credential provider program from CyberArk Software, an Israeli company. CyberArk Credential Provider suffers from a security signature issue vulnerability that stems from the vulnerability of the user identification mechanism used prior to...

Adobe Bridge 缓冲区错误漏洞

Adobe Bridge is a file viewer from Adobe. 11.1 and earlier versions of Adobe Bridge have a memory corruption vulnerability that could be exploited to execute arbitrary code in the context of the current user...

PT-2021-19514 · Cyberark · Cyberark Credential Provider

Name of the Vulnerable Software and Affected Versions: CyberArk Credential Provider versions prior to 12.1 Description: The user identification mechanism used by CyberArk Credential Provider is susceptible to a local host race condition, leading to password disclosure. Recommendations: For versio...

CVE-2021-27663

A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authorization. This issue affects: Johnson Controls CEM Systems AC2000 10.1; 10.2; 10.3; 10.4; 10.5...

qdPM 跨站脚本漏洞

qdPM is a web-based open source project management tool. A cross-site scripting vulnerability exists in qdPM 9.1, which stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Eclipse Cyclone DDS 缓冲区错误漏洞

Eclipse Cyclone DDS is a very high performance and robust open source DDS implementation from the Eclipse Foundation. A security vulnerability exists in Eclipse Cyclone DDS Project v0.1.0 that can cause the DDS user server to crash...

CVE-2021-34645

The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0...

peacexie imcat 代码注入漏洞

Imcat is a PHP-based open source website builder. A code injection vulnerability exists in peacexie imcat, which stems from a Remote Code Execution RCE vulnerability in /root/run/adm.php?admin-ediy&part=exdiy in version v5.1 of imcat that allows an authenticated attacker to execute arbitrary code...

Adobe Bridge 缓冲区错误漏洞

Adobe Bridge is a free digital asset management application from Adobe. 11.1 and earlier versions of Adobe Bridge contain a memory out-of-bounds access vulnerability. An attacker could exploit the vulnerability to execute arbitrary code...

Adobe Bridge 缓冲区错误漏洞

Adobe Bridge is a free digital asset management application from Adobe. 11.1 and earlier versions of Adobe Bridge contain a memory out-of-bounds access vulnerability. An attacker could exploit the vulnerability to cause a denial of service...

PT-2021-4984 · Adobe · Bridge

Name of the Vulnerable Software and Affected Versions: Adobe Bridge versions 11.1 and earlier Description: The issue is related to a memory corruption vulnerability due to insecure handling of a malicious Bridge file. This could potentially result in arbitrary code execution in the context of the...

GPAC Project Advanced Content 安全漏洞

A security vulnerability exists in the MPEG-4 decoding functionality of the GPAC project on Advanced Content library v1.0.1, an open source multimedia framework. The vulnerability stems from the handling of the "hdlr" FOURCC code, where a carefully constructed MPEG-4 input could lead to incorrect...

PT-2021-15287 · Pulse Secure · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R12 Description: A vulnerability could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console. Recommendations: For version...