Grid Solutions GE Reason DR60 安全漏洞

The Reason DR60 is a centralized, all-in-one multi-function digital fault recorder DFR from GE. A privilege impropriety vulnerability exists in GE Reason DR60 firmware prior to version 02A04.1. The vulnerability stems from the software performing operations with a privilege level higher than the...

UBUNTU-CVE-2021-21193

Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-26962

A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform versions: Prior to 8.2.12.0. Vulnerabilities in the AirWave CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could...

CVE-2021-26960

A remote unauthenticated cross-site request forgery csrf vulnerability was discovered in Aruba AirWave Management Platform versions: Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a...

DEBIAN-CVE-2020-25639

A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRMIOCTLNOUVEAUCHANNELALLOC. This flaw allows a local user to crash the system...

CVE-2021-26120

Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring...

CVE-2021-24115

In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations base32, base58, base64, and hex...

UBUNTU-CVE-2021-26676

gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation of bugs in gdhcp...

CVE-2021-26572

The Baseboard Management Controller BMC firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg function...

CVE-2020-10537

An issue was discovered in Epikur before 20.1.1. A Glassfish 4.1 server with a default configuration is running on TCP port 4848. No password is required to access it with the administrator account...

PT-2021-14395 · Unknown +1 · Blaze-Core +5

Name of the Vulnerable Software and Affected Versions: blaze-core versions prior to 0.14.15 http4s-blaze-server versions prior to 0.21.17 Description: The issue is caused by unbounded connection acceptance in blaze-core, leading to file handle exhaustion. This can amplify degradation in services...

PT-2021-13845 · Privoxy +3 · Privoxy +3

Name of the Vulnerable Software and Affected Versions: Privoxy versions prior to 3.0.29 Description: A flaw was found in Privoxy. Memory leaks in the client-tags CGI handler when client tags are configured and memory allocations fail can lead to a system crash. Recommendations: For versions prior...

CVE-2020-16045

Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...

Multiple Sooil Product Trust Management Issue Vulnerabilities

Sooil Dana Diabecare RS and others are products of Sooil Korea.Sooil Dana Diabecare RS is a smart insulin pump with discrete remote control for medical use.Sooil Anydana-i is a mobile application that can be used to control the Sooil Dana Diabecare RS.Sooil Anydana-i is a mobile application that...

Dell Inspiron 5675 BIOS 访问控制错误漏洞

The Dell Inspiron 5675 BIOS is a Dell USA program that provides basic inputs and outputs for the device, a self-test after powering on the device, and system self-boot functionality. A security vulnerability exists in the Dell Inspiron 5675 BIOS versions prior to version 1.4.1, which can be...

Google Chrome memory misreference vulnerability (CNVD-2021-04415)

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in Blink in versions prior to Google Chrome 87.0.4280.141. A remote attacker can exploit the vulnerability to potentially conduct an attack via a specially crafted HTML page utilizing heap...

NETGEAR NMS300 Command Injection Vulnerability (CNVD-2020-75523)

The NETGEAR NMS300 is a ProSAFE network management system. A command injection vulnerability exists in NETGEAR NMS300 versions prior to 1.6.0.27. No details of the vulnerability are provided at this time...

mariadb-connector-c: Improper validation of content in a OK packet received from server

libmariadb/mariadblib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadblib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle...

CVE-2020-25675

In the CropImage and CropImageToTiles routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsets was causing undefined behavior in the form of integer overflow and out-of-range values as reported by UndefinedBehaviorSanitizer. Such issues could cause a...

UBUNTU-CVE-2020-27765

A flaw was found in ImageMagick in MagickCore/segment.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause...