PYSEC-2021-317

The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service ReDoS via the getrgb function...

UBUNTU-CVE-2020-18976

Buffer Overflow in Tcpreplay v4.3.2 allows attackers to cause a Denial of Service via the 'dochecksum' function in 'checksum.c'. It can be triggered by sending a crafted pcap file to the 'tcpreplay-edit' binary. This issue is different than CVE-2019-8381...

CVE-2021-23431

The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery CSRF due to missing CSRF checks in various forms...

CVE-2021-39367

Canon Oce Print Exec Workgroup 1.3.2 allows Host header injection...

CVE-2021-32728

creationtimestamp| type| source ---|---|--- 2021-08-18 20:17:02+00:00| seen| https://t.me/cibsecurity/27547...

Cross-site Request Forgery (CSRF)

Overview joplin is a note taking and to-do application. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to missing CSRF checks in various forms. Remediation Upgrade joplin to version 2.3.2 or higher. References - GitHub Commit Credit: Laurent Cozic...

CVE-2021-21586

Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability. A remote authenticated malicious user could exploit this vulnerability in order to read arbitrary files on the system...

SELinux 缓冲区错误漏洞

SELinux is a Linux subsystem from the National Security Agency that uses a secure architecture that allows administrators to better control who has access to the system. A security vulnerability exists in SELinux version 3.2, which stems from a heap-based buffer overflow in the CIL compiler in...

SELinux 资源管理错误漏洞

SELinux is a Linux subsystem of the National Security Agency that utilizes a secure architecture that allows administrators to better control who has access to the system. A security vulnerability exists in SELinux version 3.2, which stems from the CIL compiler of SELinux having an after-free in...

Stored XSS vulnerability in scriptler

scriptler 3.1 and earlier does not escape script content. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Scriptler/Configure permission. scriptler 3.2 escapes script content...

PT-2021-19642

Name of the Vulnerable Software and Affected Versions: Django versions 2.2 before 2.2.22 Django versions 3.1 before 3.1.10 Django versions 3.2 before 3.2.2 Description: The issue arises from the URLValidator in Django not prohibiting newlines and tabs, unless the URLField form field is used. This...

DEBIAN-CVE-2021-31826

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable for a daemon crash on systems not using this feature if a crafted cookie is supplied...

Data Edge CA eHealth Performance Manager 代码问题漏洞

Data Edge CA eHealth Performance Manager is an application from Data Edge Ireland. provides real-time and predictive performance analytics to take corrective action before business processes are negatively impacted. A code issue vulnerability exists in Data Edge CA eHealth Performance Manager...

CVE-2021-24140

Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep5&type=test...

OPENSUSE-SU-2021:0397-1 Security update for mbedtls

This update for mbedtls fixes the following issues: - mbedtls was updated to version 2.16.9 - CVE-2020-10932: Fixed side channel in ECC code that allowed an adversary with access to precise enough timing and memory access information typically an untrusted operating system attacking a secure...

CVE-2020-24480

Out-of-bounds write in the IntelR XTU before version 6.5.3.25 may allow a privileged user to potentially enable denial of service via local access...

PT-2021-11711 · Mautic · Mautic

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 2.16.5 Mautic versions prior to 3.2.4 Description: A cross-site scripting XSS issue in the forms component allows remote attackers to inject executable JavaScript via mauticreturn. This could allow an attacker...

ALPINE-CVE-2020-25659

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS1 v1.5 ciphertext...

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms Information Disclosure Vulnerability

IBM Financial Transaction Manager for SWIFT Services is a financial transaction manager product from IBM, USA. The product is primarily used for monitoring, tracking and reporting financial payments and transactions. An information disclosure vulnerability exists in IBM Financial Transaction...

DEBIAN-CVE-2020-14305

An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this...