CVE-2021-42563

There is an Unquoted Service Path in NI Service Locator nisvcloc.exe in versions prior to 18.0 on Windows. This may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges...

CVE-2021-37987

Use after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

DEBIAN-CVE-2021-37978

Heap buffer overflow in Blink in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Oracle Java SE 1.7.0_321 / 1.8.0_311 / 1.11.0_13 / 1.17.0_1 Multiple Vulnerabilities (October 2021 CPU)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 321, 8 Update 311, 11 Update 13, or 17 Update 1. It is, therefore, affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory: - Vulnerability in the Java SE...

CVE-2021-41318

In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser...

CVE-2021-40157

A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability in FBX’s Review version 1.5.0 and prior causing it to run arbitrary code on the system...

CVE-2021-28910

BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server...

CVE-2021-40142

In OPC Foundation Local Discovery Server LDS before 1.04.402.463, remote attackers can cause a denial of service DoS by sending carefully crafted messages that lead to Access of a Memory Location After the End of a Buffer...

CVE-2021-33884

An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten...

HPESBNW04188 rev.2 - Aruba AirWave Management Platform, Multiple Vulnerabilities

Potential Security Impact: Local: Authentication Bypass; Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba AirWave Management Platform - Prior to 8.2.13.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-3156 |...

CVE-2021-38585

The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks SEC-585...

PT-2021-22216 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Editor versions prior to 11.0.1 Foxit PDF Reader versions prior to 11.0.1 Description: The issue arises from the mishandling of missing dictionary entries, resulting in a NULL pointer dereference. Recommendations: For Foxit PDF Edit...

CVE-2021-37916

Joplin before 2.0.9 allows XSS via button and form in the note body...

PT-2021-14483 · Comodo +1 · Combodo Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.7.4 Description: The issue is related to a command injection vulnerability in the Setup Wizard of Combodo iTop when providing the Graphviz executable path. Recommendations: For versions prior to 2.7.4, update ...

IDrive 授权问题漏洞

Idrive IDrive is a suite of cloud backup and cloud storage service solutions from IDrive USA. A security vulnerability exists in iDrive RemotePC versions prior to 7.6.48 that allows an unauthenticated attacker to bypass cloud authentication and connect to and control the system via TCP ports 5970...

Amazon Linux AMI : postgresql92 (ALAS-2021-1519)

The version of postgresql92 installed on the remote host is prior to 9.2.24-3.67. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1519 advisory. A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFIN...

Cisco AnyConnect Secure Mobility Client 安全漏洞

The Cisco AnyConnect Secure Mobility Client is a virtual private network VPN client for a variety of operating systems and hardware configurations. A denial of service vulnerability exists in Cisco AnyConnect Secure Mobility Client for Windows versions prior to 4.10.01075. The vulnerability stems...

DEBIAN-CVE-2021-30551

Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-3593

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6input function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or...

CVE-2021-3592

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootpinput function and could occur while processing a udp packet that is smaller than the size of the 'bootpt' structure. A malicious guest could use this flaw to leak 10 byte...