CVE-2021-46527

Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjsgetcstring at src/mjsstring.c...

Platinum UPnP SDK 路径遍历漏洞

The Platinum UPnP SDK is a cross-platform C++ library that is primarily used to build DLNA/UPnP control points. The Platinum Upnp SDK suffers from a path traversal vulnerability that stems from Platinum Upnp SDK 1.2.0 having a directory traversal vulnerability. The attack can be exploited by...

CVE-2022-0245

Cross-Site Request Forgery CSRF in GitHub repository livehelperchat/livehelperchat prior to 2.0...

Rust vec-const crate 缓冲区错误漏洞

Rust vec-const crate is a program written in the Rust language with specific functionality. security vulnerabilities exist in versions of Rust vec-const crate prior to 2.0.0, which can be exploited by attackers to cause memory corruption...

CVE-2021-37570

MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle IEEE 1905 protocols. Affected Chipsets MT7603E, MT7613, MT7615, MT7622, MT7628, MT7629, MT7915; Affected Software Versions 2.0.2; Out-of-bounds read...

CVE-2021-37569

MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle IEEE 1905 protocols. Affected Chipsets MT7603E, MT7613, MT7615, MT7622, MT7628, MT7629, MT7915; Affected Software Versions 2.0.2; Out-of-bounds write...

log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint...

CVE-2021-43065

A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to gain higher privileges via the access to sensitive system data...

Pdf2xml 代码问题漏洞

pdftoxml is an open source PDF to XML converter. pdftoxml version 2.0 of the TextPage::restoreState function has a null pointer dereference vulnerability. An attacker can exploit this vulnerability to cause a denial of service...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress plugin WP Header Images version 2.0.1...

OpenJDK: Weak ciphers preferred over stronger ones for TLS (JSSE, 8264210)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated...

CVE-2021-42261

Revisor Video Management System VMS before 2.0.0 has a directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of restricted directory on the remote server. This could lead to the disclosure of...

IBM Data Risk Manager 加密问题漏洞

IBM Data Risk Manager is a data risk manager from IBM Corporation of the United States. The product supports discovery, analysis and visualization of business risk data, etc. A security vulnerability exists in IBM Data Risk Manager iDNA 2.0.6, which could be exploited by an attacker to decrypt...

Gila CMS Cross-Site Scripting Vulnerability (CNVD-2021-84281)

Gila CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in Gila CMS version 2.2.0, which can be used by an attacker to steal cookies, passwords, or run arbitrary code on a victim's browser...

CVE-2021-29837

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204913...

October CMS 授权问题漏洞

October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. October CMS suffers from an authorization issue vulnerability where a previously deleted administrator account may still be able to log into the backend using October CMS v2.0...

CVE-2021-41878

A reflected cross-site scripting XSS vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button...

CVE-2021-41535

A vulnerability has been identified in NX 1953 Series All versions V1973.3700, NX 1980 Series All versions V1988, Solid Edge SE2021 All versions SE2021MP8. The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to...

CVE-2021-36878

Cross-Site Request Forgery CSRF vulnerability in WordPress uListing plugin versions = 2.0.5 makes it possible for attackers to update settings...

CVE-2021-34409

It was discovered that the installation packages of the Zoom Client for Meetings for MacOS Standard and for IT Admin installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for Conference before version 5.1.0, copy pre- and post-...