CVE-2021-40142

In OPC Foundation Local Discovery Server LDS before 1.04.402.463, remote attackers can cause a denial of service DoS by sending carefully crafted messages that lead to Access of a Memory Location After the End of a Buffer...

CVE-2021-33884

An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten...

HPESBNW04188 rev.2 - Aruba AirWave Management Platform, Multiple Vulnerabilities

Potential Security Impact: Local: Authentication Bypass; Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba AirWave Management Platform - Prior to 8.2.13.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-3156 |...

CVE-2021-35936

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

CVE-2021-38585

The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks SEC-585...

PT-2021-22216 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Editor versions prior to 11.0.1 Foxit PDF Reader versions prior to 11.0.1 Description: The issue arises from the mishandling of missing dictionary entries, resulting in a NULL pointer dereference. Recommendations: For Foxit PDF Edit...

CVE-2021-37916

Joplin before 2.0.9 allows XSS via button and form in the note body...

PT-2021-14483 · Comodo +1 · Combodo Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.7.4 Description: The issue is related to a command injection vulnerability in the Setup Wizard of Combodo iTop when providing the Graphviz executable path. Recommendations: For versions prior to 2.7.4, update ...

IDrive 授权问题漏洞

Idrive IDrive is a suite of cloud backup and cloud storage service solutions from IDrive USA. A security vulnerability exists in iDrive RemotePC versions prior to 7.6.48 that allows an unauthenticated attacker to bypass cloud authentication and connect to and control the system via TCP ports 5970...

Amazon Linux AMI : postgresql92 (ALAS-2021-1519)

The version of postgresql92 installed on the remote host is prior to 9.2.24-3.67. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1519 advisory. A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFIN...

Cisco AnyConnect Secure Mobility Client 安全漏洞

The Cisco AnyConnect Secure Mobility Client is a virtual private network VPN client for a variety of operating systems and hardware configurations. A denial of service vulnerability exists in Cisco AnyConnect Secure Mobility Client for Windows versions prior to 4.10.01075. The vulnerability stems...

DEBIAN-CVE-2021-30551

Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-3593

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6input function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or...

CVE-2021-3592

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootpinput function and could occur while processing a udp packet that is smaller than the size of the 'bootpt' structure. A malicious guest could use this flaw to leak 10 byte...

Annex Cloud Loyalty Experience Platform 安全漏洞

Loyalty Experience Platform is Annex Cloud's platform that combines best-in-class program management capabilities with powerful engagement modules A security vulnerability exists in Annex Cloud Loyalty Experience Platform versions prior to 2021.1.0.1, which can be exploited by an attacker to modi...

CVE-2021-0052

Incorrect default privileges in the IntelR Computing Improvement Program before version 2.4.6522 may allow an authenticated user to potentially enable an escalation of privilege via local access...

DEBIAN-CVE-2021-30534

Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

Synology Photo Station 路径遍历漏洞

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology Inc. of Taiwan, China. A path traversal vulnerability exists in Synology Photo Station versions prior to 6.8.14-3500, which can be exploited by remote attackers to write arbitrary files via...

CVE-2021-22699

Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of service when specific crafted requests are sent to the controller over HTTP...

CVE-2021-29207

A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H versions: Pri...