Plone cross-site scripting vulnerability (CNVD-2021-37195)

Plone is an open source content management system CMS built on the Zope application server. A cross-site scripting vulnerability exists in Plone versions prior to 5.2.4. The vulnerability can be exploited to cause cross-site scripting with the help of "fullname"...

Nordic Semiconductor nRF52840 注入漏洞

The Nordic Semiconductor nRF52840 is a chip from Nordic Semiconductor. An injection vulnerability exists in the Nordic Semiconductor nRF52840 version 2020-10-19 and prior versions, which stems from having incorrect protection for the physical side channel...

CVE-2021-31997

A UNIX Symbolic Link Symlink Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postorius or postorius-admin to root. This issue affects: openSUSE Leap 15.2 python-postorius version 1.3.2-lp152.1.2 and prior versions. openSUSE...

CVE-2021-3426

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to...

CVE-2021-3423

Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third party DLL to elevate privileges. This issue affects Bitdefender GravityZone Business Security versions prior to 6.6.23.329...

CVE-2021-3423

Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third party DLL to elevate privileges. This issue affects Bitdefender GravityZone Business Security versions prior to 6.6.23.329...

Oracle VirtualBox Security Update (cpuapr2021) - Windows

Oracle VirtualBox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:vmvirtualbox";...

Google TensorFlow 数字错误漏洞

Google TensorFlow is an end-to-end open source machine learning platform. A divide-by-zero error vulnerability exists in the tf.rawops.Conv2DBackpropFilter implementation in TensorFlow versions prior to 2.5.0. No detailed vulnerability details are provided at this time...

PT-2021-18332 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: Due to lack of validation in tf.raw...

WordPress Plugin SQL Injection Vulnerability

WordPress Plugin is an open source application plugin for WordPress. An SQL injection vulnerability exists in CleanTalk WordPress Plugin versions prior to 5.153.4, which originates from an update log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php that contains a vulnerable query. An attacker...

PT-2021-18273 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: The tf.raw ops.Conv3DBackprop operations...

DEBIAN-CVE-2021-29623

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying...

AZL-6531 CVE-2021-23134 affecting package kernel for versions less than 5.10.78.1-1

Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAPNETRAW capability...

CVE-2021-31913

In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirecturi were made during GitHub SSO token exchange...

Jetbrains JetBrains TeamCity 跨站脚本漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A cross-site scripting vulnerability exists in...

PT-2021-3122

Name of the Vulnerable Software and Affected Versions djvulibre versions 3.5.28 and earlier Description A flaw was found in the djvulibre library, specifically in the DJVU::DataPool::has data function, which can lead to an out of bounds read when processing a crafted djvu file. This may cause an...

PT-2021-14691 · Jenkins · Jenkins Credentials Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Credentials Plugin versions prior to 2.3.19 Description: The issue results in a reflected cross-site scripting XSS vulnerability due to the plugin not escaping user-controlled information on a view it provides. Recommendations: For...

GHSA-JGCR-FG3G-QVW8 Improper permission handling in Apache Solr

When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be...

PT-2021-3265 · Rabbitmq · Rabbitmq

Name of the Vulnerable Software and Affected Versions: RabbitMQ versions prior to 3.8.16 Description: The issue is related to insufficient access control in the plugin directory of RabbitMQ installers on Windows. This could potentially allow attackers with sufficient local filesystem permissions ...

Singularity Image Format 安全特征问题漏洞

Singularity is an open source container management platform from the Singularity team Singularity. The software supports building applications on their desktops and running hundreds or thousands of instances on any public cloud or at the compute edge. A security vulnerability exists in versions...