Leptonica heap buffer overflow vulnerability (CNVD-2021-19745)

Leptonica is an open source library containing software widely used in image processing and image analysis applications. A heap buffer overflow vulnerability exists in findNextBorderPixel in ccbord.c in versions of Leptonica prior to 1.80.0. No details of the vulnerability are provided at this ti...

PT-2021-17178 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 1.8.4 Description: An issue in Argo CD allows accessing the "api/version" endpoint, which leaks internal system information. This endpoint is not protected with authentication. Recommendations: For versions prior to...

Synology DiskStation Manager 资源管理错误漏洞

DiskStation Manager DSM is an operating system that runs on all Synology NAS and can be operated through an intuitive web interface. A post-release reuse vulnerability exists in iscsisnapshotcommcore in Synology DiskStation Manager versions prior to 6.2.3-25426-3. A remote attacker can exploit th...

PT-2021-14450 · Msgpack5 · Msgpack5

Name of the Vulnerable Software and Affected Versions: msgpack5 versions prior to 3.6.1 msgpack5 versions prior to 4.5.1 msgpack5 versions prior to 5.2.1 Description: The issue occurs when msgpack5 decodes a map containing a key proto , assigning the decoded value to proto . This allows an attack...

CVE-2020-1919

Incorrect bounds calculations in substrcompare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions...

CVE-2020-1917

xbufformatconverter, used as part of exifreaddata, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to...

CVE-2020-1921

In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions...

CVE-2020-1919

Incorrect bounds calculations in substrcompare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions...

CVE-2021-20668

Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL...

Adobe Creative Cloud Desktop Application 跨站脚本漏洞

Adobe Connect is an online video conferencing software. A reflected cross-site scripting vulnerability exists in Adobe Connect 11.0.5 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary JavaScript in a browser...

F5 Networks BIG-IP : BIG-IP SNAT vulnerability (K31934524)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.3 / 12.1.5.3 / 13.1.3.6 / 14.1.4 / 15.1.2.1 / 16.0.1.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K31934524 advisory. - On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before...

DEBIAN-CVE-2021-21183

Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

DEBIAN-CVE-2021-21174

Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

DEBIAN-CVE-2021-21167

Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-21169

Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page...

UBUNTU-CVE-2021-21180

Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-21163

Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server...

CVE-2020-8356

An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture FFDC service log. The FFDC...

PT-2021-13866 · Privoxy +2 · Privoxy +2

Name of the Vulnerable Software and Affected Versions: privoxy versions prior to 3.0.32 Description: A flaw was found in the software, which may cause a crash due to a NULL-pointer dereference when the socks server misbehaves. Recommendations: For versions prior to 3.0.32, update to version 3.0.3...

PT-2021-14423 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.4 Description: The issue allows creating tickets for another user with the self-service interface without having delegatee systems enabled. Recommendations: For versions prior to 9.5.4, update to version 9.5.4 to...