11002 matches found
Mozilla: JavaScript unexpectedly enabled for the composition area
Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. This vulnerability affects Thunderbird...
Unitrends Backup SQL Injection Vulnerability
Unitrends Backup is designed to eliminate data loss, ransomware and risk. A SQL injection vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...
CVE-2021-36781
A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1...
PT-2021-23944 · Unknown +1 · Express-Session +1
Name of the Vulnerable Software and Affected Versions: Etherpad versions prior to 1.8.16 Description: Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an .etherpad file that, when imported, might allow the attacker to gain admin privileges for the...
DEBIAN-CVE-2021-43536
Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...
CVE-2021-41450
An HTTP request smuggling attack in TP-Link AX10v1 before v1211117 allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet...
CVE-2021-25523
Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Account ID...
CVE-2021-25524
Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account ID...
PT-2021-16705 · Unknown · Semrewardmanager
Name of the Vulnerable Software and Affected Versions: SemRewardManager versions prior to SMR Dec-2021 Release 1 Description: The issue is related to an improper usage of implicit intent in SemRewardManager, allowing attackers to access BSSID. Recommendations: For versions prior to SMR Dec-2021...
Samsung SMR 输入验证错误漏洞
Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in versions prior to Samsung SMR Dec-2021 Release 1, which can be exploited by an attacker to execute arbitrary code locally...
CVE-2021-43638
Amazon Amazon WorkSpaces agent is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service memory corruption and OS crash via specially crafted I/O Request Pack...
Apereo CAS 跨站脚本漏洞
Apereo CAS is a web-based enterprise multilingual single sign-on solution. versions prior to Apereo CAS 6.4.1 have a security vulnerability that can be exploited by attackers to send XSS via POST requests to REST API endpoints...
CVE-2021-43039
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Samba file sharing service allowed anonymous read/write access...
PT-2021-23731 · Kaseya · Kaseya Unitrends Backup Appliance
Name of the Vulnerable Software and Affected Versions: Kaseya Unitrends Backup Appliance versions prior to 10.5.5 Description: A buffer overflow issue existed in the vaultServer component, which was exploitable by a remote unauthenticated attacker. Recommendations: For versions prior to 10.5.5,...
CVE-2021-44047
A use-after-free vulnerability exists when reading a DWF/DWFX file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing DWF/DWFX files. Crafted data in a DWF/DWFX file and lack of proper validation of input data can trigger a write operation past the end ...
PT-2021-21591 · M Files · M-Files Web
Name of the Vulnerable Software and Affected Versions: M-Files Web versions prior to 20.10.9524.1 Description: The issue allows a denial of service via overlapping ranges in HTTP requests with crafted Range or Request-Range headers. It is disputed because the range behavior is the responsibility ...
GNU Mailman 跨站请求伪造漏洞
GNU Mailman is a free suite of software from the GNU community for managing e-mail discussions and e-mail lists. The software integrates with Web projects to make it easy for users to manage email subscription accounts and provides built-in archiving, automatic forwarding processing, content...
CVE-2021-20859
ELECOM LAN routers WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior,...
CVE-2021-20852
Buffer overflow vulnerability in ELECOM LAN routers WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior allows a network-adjacent attacker with an administrator privilege to execute an arbitrary OS command via unspecified vectors...
