PT-2021-6611 · Xen +1 · Xen +1

Name of the Vulnerable Software and Affected Versions: Xen affected versions not specified Description: The issue is related to an inadequate grant-v2 status frames array bounds check in the Xen hypervisor. This allows a guest to potentially cause a denial of service by exploiting the vulnerabili...

CVE-2021-3573

A use-after-free in function hcisockboundioctl of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hciunregisterdev together with one of the calls hcisockblacklistadd, hcisockblacklistdel, hcigetconninfo,...

CVE-2021-36706

ProLink PRC2402M routers (version 1.0.18 and earlier) contain a command injection vulnerability in the adm.cgi page handler set_sys_cmd. The vulnerability is triggered by a sysCMD parameter value that is passed directly to the system() call, allowing an attacker to execute arbitrary commands. Pub...

CVE-2021-36705

In ProLink PRC2402M V1.0.18 and older, the setTR069 function in the adm.cgi binary, accessible with a page parameter value of TR069 contains a trivial command injection where the value of the TR069localport parameter is passed directly to system...

Brocade Fabric OS 授权问题漏洞

Brocade Fabric OS FOS is a set of embedded operating systems used in devices such as switches and routers from Brocade USA. Brocade Fabric OS has a security vulnerability. An attacker could exploit the vulnerability to bypass restrictions via empty passwords in order to escalate their privileges...

CVE-2021-20430

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196341...

CVE-2021-29784

IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 203168...

Information disclosure

IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 203168...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2021:2427-1 Rating: important References: 1153720 1174978 1179610 1181193 1185428 1185701 1185861 1186463 1186484 1187038 1187050 1187215 1187452 1187554 1187595 1187601 1188062 1188116 Cross-References:...

CVE-2021-32773

Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket sandbox could cause system modules to incorrectly use attacker-created modules instead of their intended dependencies. This could allow...

Arbitrary file reading vulnerability in qimengcms

qimengcms is a content management system. qimengcms has an arbitrary file read vulnerability that can be exploited by attackers to obtain sensitive information...

Halo 跨站脚本漏洞

Halo is a personal blogging system for individual developers. Halo suffers from a cross-site scripting vulnerability that stems from a cross-site scripting XSS vulnerability via the X-forwarded-for Header parameter in Halo 0.4.3. An attacker could exploit the vulnerability to execute client-side...

Google Android System Remote Code Execution Vulnerability (CNVD-2021-52330)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. A remote code execution vulnerability exists in the System component of Google Android versions 8.1, 9, 10, and 11, which can be exploited by an attacker to achieve...

Google Android System Information Disclosure Vulnerability (CNVD-2021-52336)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. An information disclosure vulnerability exists in the System component of Google Android versions 8.1, 9, 10, and 11, which can be exploited by an attacker to cause...

Code injection

IBM Guardium Data Encryption GDE 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 195709...

Google Android 缓冲区错误漏洞

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. An elevation of privilege vulnerability exists in the System component of Google Android versions 8.1, 9, 10, and 11, which can be exploited by an attacker to cause...

osTicket Cross-Site Scripting Vulnerability

osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.12.6. An attacker can exploit this vulnerability via the queue-name parameter in include/class.queue.php...

Weidmueller Industrial WLAN devices operating system command injection vulnerability (CNVD-2021-48131)

Weidmueller Industrial WLAN devices is an industrial WIAN from Weidmueller, Germany. The Weidmueller Industrial WLAN devices operating system command injection vulnerability can be exploited by an attacker to take full control of the device via specially crafted network configuration information...

Google Android Information Disclosure Vulnerability (CNVD-2021-45436)

Google Android is a Linux-based open source operating system from the Google Open Handheld Consortium Google. Google Android 11 suffers from an information disclosure vulnerability. The vulnerability arises due to an out-of-bounds read due to a heap buffer overflow in ih264efmtconv.c in...

Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings

Impact All versions of Pterodactyl Wings preior to 1.4.4 are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstream impacts to other clients on the same hardware, eventually...