PT-2021-3332 · Wago · Wago Pfc 200

Name of the Vulnerable Software and Affected Versions: WAGO PFC200 devices affected versions not specified Description: The issue is related to the WAGO PFC200 devices, where an authorized attacker with network access can access the file system with higher privileges using specially crafted...

SearchBlox File Inclusion Vulnerability

SearchBlox is an application from US-based SearchBlox, Inc. Provides a powerful enterprise search architecture for on-premise or cloud deployments. A security vulnerability exists in SearchBlox versions prior to 9.2.2 that allows remote, unauthenticated users to read arbitrary files from the...

Debian DSA-4917-1 : chromium - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2021-30506 @retsew0x01 discovered an error in the Web App installation interface. - CVE-2021-30507 Alison Huffman discovered an error in the Offline mode. - CVE-2021-30508 Leecraso and Guang Gong discovered a buffer...

Adobe Acrobat/Reader Out-of-Bounds Read Vulnerability (CNVD-2021-49207)

Adobe Acrobat is a PDF editing software developed by Adobe.Adobe Reader also known as Acrobat Reader is a PDF file reader developed by Adobe. Adobe Acrobat/Reader has an out-of-bounds read vulnerability. An attacker can exploit this vulnerability to read arbitrary file systems...

Citrix Systems Workspace App 安全漏洞

Citrix Systems Workspace App formerly known as Receiver is an application from Citrix Systems, Inc. that is used to provide secure access to applications, desktops and data. A security vulnerability exists in Citrix Workspace. The vulnerability could cause a local user to escalate their privilege...

Security Bulletin: Go is vulnerable to a denial of service on IBM Watson Machine Learning on CP4D

Summary Golang Go is vulnerable to a denial of service and bypass security restrictions on IBM Watson Machine Learning on CP4D Vulnerability Details CVEID: CVE-2020-15586 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a data race in some net/http servers. By sending...

CVE-2021-29475

HedgeDoc formerly known as CodiMD is an open-source collaborative markdown editor. An attacker is able to receive arbitrary files from the file system when exporting a note to PDF. Since the code injection has to take place as note content, there fore this exploit requires the attackers ability t...

CVE-2021-1074

NVIDIA GPU Display Driver for Windows installer contains a vulnerability where an attacker with local unprivileged system access may be able to replace an application resource with malicious files. This attack requires a user with system administration rights to execute the installer and requires...

CVE-2021-1074

CVE-2021-1074 affects the NVIDIA Windows GPU Display Driver installer. The vulnerability enables a local-privilege attacker with system access to replace an application resource with malicious files during a narrow window between file integrity validation and execution, potentially enabling code ...

CVE-2021-21070 Privilege Escalation Vulnerability in Adobe RoboHelp

Adobe Robohelp version 2020.0.3 and earlier is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with admin permissions to write to the file system could leverage this vulnerability to escalate privileges...

SUSE: Security Advisory (SUSE-SU-2019:2478-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FBI shuts down malware on hundreds of Exchange servers, opens Pandora’s box

A rather remarkable story has emerged, setting the scene for lively debates about permissible system access. A press release from the US Department of Justice Judge has revealed that the FBI were granted permission to perform some tech support backdoor removal. Bizarrely, they did this without...

FreeBSD Competitive Conditions Vulnerability (CNVD-2021-36023)

FreeBSD is a set of Unix-like operating systems from the Freebsd Foundation. FreeBSD suffers from a Competitive Conditions Problem vulnerability that can be exploited by an attacker to gain access to the file system hierarchy...

CVE-2021-25361

An improper access control vulnerability in stickerCenter prior to SMR APR-2021 Release 1 allows local attackers to read or write arbitrary files of system process via untrusted applications...

Default credentials

Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. The ssh key can provide an attacker access to the linux system in the affected version...

CVE-2021-21634

Jenkins Jabber XMPP notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2021-27273

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

Cisco IOS XE SD-WAN Parameter Injection Vulnerability

Cisco IOS XE is an open and flexible operating system optimized for future work. A parameter injection vulnerability exists in Cisco IOS XE versions after 17.3.1. The vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit the vulnerability to gain...

CVE-2021-1437

A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. This vulnerability is due to an unrestricted Trivial File Transfer Protocol TFTP...

CVE-2021-1385

A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticated, remote attacker to conduct directory traversal attacks and read and write files on the underlying operating system or host system. This vulnerability occurs because the devic...