CVE-2021-27180

An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail aka WorldClient. It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user...

CVE-2021-28856

In Deark before v1.5.8, a specially crafted input file can cause a division by zero in src/fmtutil.c because of the value of pixelsize...

nodejs-bootstrap-select: not escaping title values on <option> may lead to XSS

bootstrap-select before 1.13.6 allows Cross-Site Scripting XSS. It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser...

CVE-2021-0248

This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an attacker to take over any instance of an NFX deployment. This issue is only exploitable through administrative interfaces. This issue affects: Junip...

CVE-2021-0239

In Juniper Networks Junos OS Evolved, receipt of a stream of specific genuine Layer 2 frames may cause the Advanced Forwarding Toolkit AFT manager process Evo-aftmand, responsible for handling Route, Class-of-Service CoS, Firewall operations within the packet forwarding engine PFE to crash and...

Mozilla: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key

If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might...

Google Chrome 安全特征问题漏洞

Chrome is a web browsing tool developed by Google. A security vulnerability exists in Google Chrome versions prior to 90.0.4430.72. An attacker can exploit the vulnerability to spoof the security UI via a crafted HTML page...

Npm Braces Resource Management Error Vulnerability

Npm Braces is an application from Npm USA. bracketed extension of Bash, implemented in JavaScript. A security vulnerability exists in versions of Braces prior to 2.3.1, which can be exploited by an attacker to use a regular expression denial of service ReDoS attack...

PT-2021-17966

Name of the Vulnerable Software and Affected Versions: Deark versions prior to 1.5.8 Description: A specially crafted input file can cause a division by zero in the src/fmtutil.c file due to the value of pixelsize. Recommendations: For versions prior to 1.5.8, update to version 1.5.8 or later to...

CVE-2021-22716

A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code execution when an unprivileged user modifies a file. Affected Product: C-Bus Toolkit V1.15.9 and prior...

PT-2021-15430 · Eaton · Eaton Intelligent Power Manager

Name of the Vulnerable Software and Affected Versions: Eaton Intelligent Power Manager IPM versions prior to 1.69 Description: The issue concerns an unauthenticated eval injection vulnerability. It arises because the software fails to neutralize code syntax from users before using it in the dynam...

Gradle 安全漏洞

Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A security vulnerability exists in Gradle version 5.1 and prior to version 7.0, which could lead to information disclosure and/or dependency poisoning...

Eaton Intelligent Power Manager 输入验证错误漏洞

Eaton Intelligent Power Manager IPM is an intelligent power manager from Eaton Corporation that supports remote monitoring and management of multiple devices in a network from an interface. An arbitrary file deletion vulnerability exists in Eaton Intelligent Power Manager versions prior to 1.69,...

PT-2021-23137 · Unknown +1 · Freeswitch +1

Name of the Vulnerable Software and Affected Versions: FreeSWITCH versions prior to v1.10.6 Description: The issue concerns the lack of authentication for SIP requests of the type SUBSCRIBE in FreeSWITCH. This allows attackers to subscribe to user agent event notifications without authentication,...

Eaton Intelligent Power Manager 代码问题漏洞

Eaton Intelligent Power Manager IPM is an intelligent power manager from Eaton Corporation that supports remote monitoring and management of multiple devices in a network from an interface. An arbitrary file upload vulnerability exists in Eaton Intelligent Power Manager IPM versions prior to 1.69...

Patreon WordPress Cross-Site Scripting Vulnerability

Patreon is a subscription-based crowdfunding platform and Patreon WordPress is a WordPress plugin for the platform. A cross-site scripting vulnerability exists in the login form in Patreon WordPress versions prior to 1.7.2. An attacker can exploit this vulnerability to conduct cross-site scriptin...

PT-2021-13840 · Unknown +4 · Cifs-Utils +4

Name of the Vulnerable Software and Affected Versions: cifs-utils versions prior to 6.13 Description: A flaw was found in cifs-utils where a user mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to dat...

Redis Heap Overflow Vulnerability (Oct 2020)

Redis is prone to a heap overflow vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redis:redis"; if description...

UBUNTU-CVE-2021-21393

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party...

Dell Peripheral Manager 代码问题漏洞

Dell Peripheral Manager is an application from Dell USA. It provides on-screen instructions on how to pair other devices with your computer via Bluetooth. An elevation of privilege vulnerability exists in Dell Peripheral Manager versions prior to 1.3.1, which can be exploited by an attacker to ga...