GHSA-M489-XR35-FJXR Regular Expression Denial of Service in millisecond

Versions of millisecond prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed. Proof of concept var ms = require'millisecond'; var genstr = function len, chr var result = ""; for i=0; i=len; i++ result = result + chr;...

ownCloud < 4.0.7 Multiple Vulnerabilities (oC-SA-2012-012, oC-SA-2012-013, oC-SA-2012-014, oC-SA-2012-015)

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...

ownCloud < 4.0.5 Multiple Vulnerabilities (oC-SA-2012-018)

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...

ownCloud < 4.0.1 Multiple XSS Vulnerabilities

ownCloud is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross site request forgery (csrf)

Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, that - when visited, allows them control of the list control panel as if the bad actor was logged in themselves. This includes changing any...

WordPress Live Search for WooCommerce plugin <= 1.3.1 - Multiple vulnerabilities

Multiple vulnerabilities Authenticated Arbitrary WordPress Options Change, Read and Deletion / Authenticated User Enumeration / Authenticated Plugin Settings Change, Import and Export were discovered by Jerome Bruandet NinTechNet in WordPress Live Search for WooCommerce plugin versions = 1.3.1...

WordPress Add Product Tabs for WooCommerce plugin <= 1.4.1 - Multiple vulnerabilities

Multiple vulnerabilities Authenticated Arbitrary WordPress Options Change, Read and Deletion / Authenticated User Enumeration / Authenticated Plugin Settings Change, Import and Export were discovered by Jerome Bruandet NinTechNet in WordPress Add Product Tabs for WooCommerce plugin versions =...

CVE-2021-39215

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue...

CVE-2021-39215

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue...

PT-2021-6865 · Adobe · Acrobat 2020 +5

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat versions prior to 2021.005.20060 Adobe Acrobat Reader versions prior to 2021.005.20060 Adobe Acrobat 2017 versions prior to 2017.011.30199 Adobe Acrobat Reader 2017 versions prior to 2017.011.30199 Adobe Acrobat 2020 versions...

Docker < 1.3.0 Image Redirect Vulnerability

Docker is prone to a vulnerability regarding image IDs. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

Docker < 1.2.1 Container Override Vulnerability

Container names in Docker may collide with and override container IDs. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Docker < 1.3.2 Privilege Escalation Vulnerability

Docker is prone to a privilege escalation vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

PT-2021-18249 · October · October/System

Name of the Vulnerable Software and Affected Versions: october/system package versions prior to v1.1.5 october/system package versions prior to Build 472 Description: The issue allows an attacker to bypass authentication and take over a user account on an October CMS server. This can be exploited...

CVE-2021-39157

detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in detect-character-encoding v0.7.0. No workaround are available and all...

PT-2021-8247 · Apple · Macos Monterey +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.1 macOS Big Sur versions prior to 11.6.2 Description: A logic issue was addressed with improved state management, allowing a malicious application to bypass Privacy preferences. This issue may lead to data leakage. ...

PT-2021-19038 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15 iPadOS versions prior to 15 Description: An access issue was addressed with improved access restrictions. An attacker in a privileged network position may be able to leak sensitive user information. Recommendations: F...

PT-2021-19036 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.6 iPadOS versions prior to 14.6 Description: The issue was addressed with improved permissions logic. A user may be unable to fully delete browsing history. Recommendations: For iOS versions prior to 14.6, update to i...

PT-2021-22564 · Gnome +7 · Gnome Libgfbgraph +7

Name of the Vulnerable Software and Affected Versions: GNOME libgfbgraph versions prior to 0.2.5 Description: The issue is related to the lack of TLS certificate verification in the SoupSessionSync objects created by gfbgraph-photo.c, making users susceptible to network man-in-the-middle MITM...

PT-2021-7414 · Redmine · Redmine

Name of the Vulnerable Software and Affected Versions: Redmine versions 4.1.5 and earlier Redmine versions 4.2.x before 4.2.3 Description: The issue is related to an insufficient access filter, which may disclose the names of users on activity views. This allows a remote attacker to access...