11004 matches found
Linux kernel denial of service vulnerability (CNVD-2021-25962)
The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A denial of service vulnerability exists in the netfilter subsystem in Linux kernel versions prior to 5.11.11. The...
PT-2021-17407 · Woocommerce · Advanced Order Export For Woocommerce
Name of the Vulnerable Software and Affected Versions: WooCommerce Advanced Order Export versions prior to 3.1.8 Description: The issue allows for XSS. Recommendations: For versions prior to 3.1.8, update to version 3.1.8 or later to resolve the issue...
Seth Vargo Exposure Notification Verification Server 输入验证错误漏洞
Seth Vargo exposure-notifications-verification-server is an open source application by Seth Vargo. It is the reference implementation of the Exposure Notifications Verification Server, which is part of the broader Google Exposure Notifications system. A security vulnerability in Seth Vargo Exposu...
A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example by convincing a user to open a file in an application using cairo or if an application uses cairo on untrusted input) to cause a stack buffer overflow -> out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality integrity as well as system availability.
...
PT-2021-6745 · Smarty +2 · Smarty +2
Name of the Vulnerable Software and Affected Versions: Smarty versions prior to 3.1.42 and 4.0.2 Description: The issue is related to the incorrect handling of code generation in the Smarty template engine for PHP. This allows template authors to run arbitrary PHP code by crafting a malicious mat...
DEBIAN-CVE-2021-23358
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized...
ImageMagick heap buffer overflow vulnerability (CNVD-2021-23794)
ImageMagick is a software for creating, editing, and composing images that can read, convert, and write images in many formats. A heap buffer overflow vulnerability exists in coders/tiff.c in versions of ImageMagick prior to 7.0.10-45. An attacker can exploit this vulnerability to cause a denial ...
PT-2021-7695 · Unknown +1 · Net::Netmask +1
Name of the Vulnerable Software and Affected Versions: Net::Netmask versions prior to 2.0000 Description: The issue is related to the improper handling of extraneous zero characters at the beginning of an IP address string, which can allow attackers to bypass access control based on IP addresses...
Linux kernel denial of service vulnerability (CNVD-2021-24269)
The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A denial of service vulnerability exists in usbipsockfdstore in drivers/usb/usbip/stubdev.c in versions of Linux kern...
npm Braces 资源管理错误漏洞
Npm Braces is an application from Npm USA. bracketed extension of Bash, implemented in JavaScript. A security vulnerability exists in versions of Braces prior to 2.3.1, which can be exploited by an attacker to use a regular expression denial of service ReDoS attack...
CVE-2020-25840
Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could cause configuration destruction...
CVE-2021-27454
The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses on the Reason DR60 all firmware versions prior to 02A04.1...
Hardcoded credentials
The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 all firmware versions prior to 02A04.1...
CVE-2021-27438
The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 all firmware versions prior to 02A04.1...
CVE-2021-27452
The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentials on the MU320E all firmware versions prior to v04A00.1...
CVE-2021-20213
A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get the request destination from the Host header and a memory allocation failed...
UBUNTU-CVE-2021-3446
A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV initialization vector when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the calle...
CVE-2020-6785
Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as well as the installed application. This...
Apache SpamAssassin 操作系统命令注入漏洞
Apache SpamAssassin is an open source spam filter from the Apache USA Foundation. The product provides system administrators with a filter and support for categorizing email to block spam. An injection vulnerability exists in Apache SpamAssassin versions prior to 3.4.5 that allows configuration o...