hw: Fast forward store predictor

A flaw was found in the CPU microarchitecture where a local attacker is able to abuse a timing issue which may allow them to infer internal architectural state from previous executions on the CPU...

HedgeDoc Cross-Site Scripting Vulnerability (CNVD-2021-93909)

HedgeDoc is a platform for writing and sharing Markdown. cross-site scripting vulnerabilities exist in versions of HedgeDoc prior to 1.9.0. An attacker could exploit the vulnerability by embedding an iframe hosting malicious code into a slideshow or embedding a HedgeDoc instance into another page...

CVE-2021-27913

The function mtrand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under...

CVE-2020-15744

Stack-based Buffer Overflow vulnerability in the ONVIF server component of Victure PC420 smart camera allows an attacker to execute remote code on the target device. This issue affects: Victure PC420 firmware version 1.2.2 and prior versions...

ZOHO ManageEngine Log360 跨站请求伪造漏洞

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity and comply with regulatory requirements.A code injection...

CVE-2021-40142

In OPC Foundation Local Discovery Server LDS before 1.04.402.463, remote attackers can cause a denial of service DoS by sending carefully crafted messages that lead to Access of a Memory Location After the End of a Buffer...

CVE-2021-30602

Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit heap corruption via a crafted HTML page...

AZL-6432 CVE-2021-40145 affecting package gd for versions less than 2.3.0-5

gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes...

CVE-2021-32995

Cscape All Versions prior to 9.90 SP5 lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute code in the context of the current process...

CVE-2021-33884

An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten...

PT-2021-7242 · Opc Foundation · Opc Foundation Local Discovery Server

Name of the Vulnerable Software and Affected Versions: OPC Foundation Local Discovery Server LDS versions prior to 1.04.402.463 Description: The issue is related to a denial of service DoS that can be caused by remote attackers sending carefully crafted messages, leading to access of a memory...

opensysusers 代码注入漏洞

opensysusers is an open source package. It is an alternative implementation of systemd-sysusers that can be run on systems with or without systemd installed. A code injection vulnerability exists in versions of opensysusers prior to 0.6, which poses a security risk primarily due to the use of...

F5 Networks BIG-IP : TMM SCTP vulnerability (K94941221)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.4.1 / 14.1.4.3 / 15.1.3.1 / 16.0.1.2 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K94941221 advisory. - On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before...

HPESBNW04188 rev.2 - Aruba AirWave Management Platform, Multiple Vulnerabilities

Potential Security Impact: Local: Authentication Bypass; Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba AirWave Management Platform - Prior to 8.2.13.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-3156 |...

hw: Fast forward store predictor

A flaw was found in the CPU microarchitecture where a local attacker is able to abuse a timing issue which may allow them to infer internal architectural state from previous executions on the CPU...

PT-2021-18974 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.0.1 Description: A race condition was addressed with improved locking, which may allow a malicious application to execute arbitrary code with kernel privileges. Recommendations: For versions prior to 12.0.1, update ...

PT-2021-18933 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15.1 iPadOS versions prior to 15.1 Description: A lock screen issue allowed unauthorized access to contacts on a locked device. This was possible due to inadequate state management. A local attacker could potentially vie...

Wordpress Plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the Wordpress...

PT-2021-22399 · Xstream +5 · Xstream +5

Name of the Vulnerable Software and Affected Versions: XStream versions prior to 1.4.18 Description: The issue may allow a remote attacker to allocate 100% CPU time on the target system, depending on CPU type or parallel execution of a payload, resulting in a denial of service by manipulating the...

PT-2021-22409

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.18 Description XStream is a simple library to serialize objects to XML and back again. In affected versions, this issue may allow a remote attacker to request data from internal resources that are not publicly...