PT-2021-10564 · Ukcms · Ukcms

Name of the Vulnerable Software and Affected Versions: UK CMS version 1.1.10 Description: A stored cross site scripting XSS vulnerability in "index.php/legend/6.html" of UK CMS allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section. Recommendations...

CVE-2020-20977: Improper Neutralization of Input During Web Page Generation

A stored cross site scripting XSS vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section...

gcc-toolset-10-valgrind bug fix and enhancement update

An update is available for gcc-toolset-10-valgrind. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GCC Toolset is a compiler toolset that provides recent versio...

gcc-toolset-10-valgrind bug fix and enhancement update

GCC Toolset is a compiler toolset that provides recent versions of development tools. GCC Toolset is an Application Stream packaged as a Software Collection. Bug fixes: incorrect pkgconfig virtual provides in devel packages BZ1968378 For instructions on usage, see Using GCC Toolset linked from th...

DEBIAN-CVE-2020-24826

A vulnerability in the elf::section::asstrtab function of Libelfin v0.3 allows attackers to cause a denial of service DOS through a segmentation fault via a crafted ELF file...

CVE-2020-24826

A vulnerability in the elf::section::asstrtab function of Libelfin v0.3 allows attackers to cause a denial of service DOS through a segmentation fault via a crafted ELF file...

UBUNTU-CVE-2020-24826

A vulnerability in the elf::section::asstrtab function of Libelfin v0.3 allows attackers to cause a denial of service DOS through a segmentation fault via a crafted ELF file...

CVE-2020-24826

A vulnerability in the elf::section::asstrtab function of Libelfin v0.3 allows attackers to cause a denial of service DOS through a segmentation fault via a crafted ELF file...

CVE-2020-24826: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability in the elf::section::asstrtab function of Libelfin v0.3 allows attackers to cause a denial of service DOS through a segmentation fault via a crafted ELF file...

PT-2021-6584

Name of the Vulnerable Software and Affected Versions GPAC version 0.8.0 Description The issue is related to a heap-based buffer overflow in the gf m2ts section complete function in media tools/mpegts.c, which can cause a denial of service DOS via a crafted MP4 file. This can be exploited by a...

GPAC 缓冲区错误漏洞

GPAC is an open source multimedia framework. GPAC has a buffer overflow vulnerability in v0.8.0, which originates from a buffer overflow in gfm2tssectioncomplete in mediatools/mpegts.c. An attacker could use this vulnerability to cause a denial of service DOS via a specially crafted MP4 file...

PT-2021-6508

Name of the Vulnerable Software and Affected Versions Libelfin version 0.3 Description The issue is related to insufficient neutralization of special elements in a request, specifically in the elf::section::as strtab function of the Libelfin library for reading ELF and DWARFv4 files. This allows ...

Libelfin 注入漏洞

Libelfin is a C 11 library for reading ELF binaries and DWARFv4 debug information. A denial of service vulnerability exists in the elf::section::asstrtab function of Libelfin 0.3. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted ELF file that cause...

PT-2021-20115

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.0.0 through 7.3.2 Liferay DXP 7.0 before fix pack 94 Liferay DXP 7.1 before fix pack 19 Liferay DXP 7.2 before fix pack 6 Description The Dynamic Data Mapping module does not properly check user permissions, allowing...

KLA12248 Microsoft Advisory (ESU) for Active Directory Certificate Services

Microsoft is aware of PetitPotam which can potentially be used in an attack on Windows domain controllers or other Microsoft Products Extended Security Update.To prevent NTLM Relay Attacks on networks with NTLM enabled, domain administrators must ensure that services that permit NTLM authenticati...

Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr

✍️ Description In Bank section the POS part, you don't protect resources from delete with CSRF attacks and then I able to delete/close arbitrary POS cash desk control entities only with knowing their ids. 🕵️‍♂️ Proof of Concept // PoC.html history.pushState'', '', '/' 💥 Impact This vulnerability is...

Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr

✍️ Description In Bank section the Bank | Cash part, you protect List entities to delete with CSRF attacks but if I set CSRF token to nothings then I able to delete arbitrary List entities only with knowing their ids. 🕵️‍♂️ Proof of Concept // PoC.html history.pushState'', '', '/' input...

Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr

✍️ Description In Ticket section , you protect tickets from being deleted with CSRF attacks but if I set CSRF token to nothings then I able to delete arbitrary tickets only with knowing their "trackid" parameter. 🕵️‍♂️ Proof of Concept // PoC.html history.pushState'', '', '/' 💥 Impact This...

Important: Red Hat Security Advisory: kpatch-patch security update

An update is now available for Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

KLA12239 PE vulnerability in Microsoft Windows

An elevation of privilege vulnerability was found in Microsoft Windows. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2021-36934 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware is...