Cross-Site Scripting via SVG media files

Impact Cross-Site Scripting via SVG media files Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of...

PT-2021-21360 · Typo3 · Dated News

Name of the Vulnerable Software and Affected Versions: dated news extension versions through 5.1.1 for TYPO3 Description: The issue concerns incorrect Access Control for confirming various applications. Recommendations: For dated news extension versions through 5.1.1, update to a version later th...

PT-2021-6286 · Adobe · Magento Commerce

Name of the Vulnerable Software and Affected Versions: Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier Magento Commerce version 2.3.7 and earlier Description: The issue is related to improper authorization in Magento Commerce, allowing an attacker with admin privileges to...

Cross site scripting via HTML attributes in the back end

Date : 2021-08-11 CVE ID : CVE-2021-35955 Description It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview back end and on the website front end. Installations are only affected if there are untrusted...

PT-2021-24338 · Mariadb +7 · Mariadb +8

Name of the Vulnerable Software and Affected Versions: MariaDB versions prior to 10.6.3 Description: The issue arises from the incorrect handling of with window func=true for a subquery in the save window function values function, leading to an application crash. Recommendations: For MariaDB...

Input validation

An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno and can bypass validation. This can allow the attacker to read memory from within the secure enclave. We recommend updating to Asy...

PT-2021-14613 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 9.1.0.3 and earlier Description: The issue is a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU and potentially preventing other SmartConnect DNS...

PT-2021-7963 · Mdadm +3 · Mdadm +3

Name of the Vulnerable Software and Affected Versions: Mdadm versions prior to 4.2-rc2 Description: The issue is related to uncontrolled resource consumption in the Mdadm utility for managing RAID arrays. This could allow an attacker to cause a denial of service via local access. A privileged use...

PT-2021-6566 · Oracle +11 · Mysql Server +10

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.7.34 and prior MySQL Server versions 8.0.25 and prior Description: The vulnerability is related to errors in resource release in the InnoDB component of the MySQL Server. It allows a remote attacker to cause a denial o...

PT-2021-11005 · Unknown · Radare2-Extras

Name of the Vulnerable Software and Affected Versions: Radare2-extras versions before commit e74a93c Description: A heap buffer overflow vulnerability in the r asm swf disass function allows attackers to execute arbitrary code or carry out denial of service DOS attacks. Recommendations: For...

PT-2021-3815

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2013 through 2019 Description The issue is related to errors in code generation management, allowing a remote attacker to execute arbitrary code. This can impact the system. The estimated number of potentiall...

PT-2021-13680 · Qualcomm · Snapdragon Industrial Iot +6

Name of the Vulnerable Software and Affected Versions: Snapdragon Auto versions prior to the fixed version Snapdragon Compute versions prior to the fixed version Snapdragon Connectivity versions prior to the fixed version Snapdragon Consumer IOT versions prior to the fixed version Snapdragon...

PT-2021-20437 · Siemens · Teamcenter Visualization +1

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to V13.2 Teamcenter Visualization versions prior to V13.2 Description: A vulnerability has been identified in the BMP Loader.dll library, which lacks proper validation of user-supplied data when parsing BMP files. This...

PT-2021-4241 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.13.4 Description: The issue is caused by a buffer overflow on the stack in the drivers/char/virtio console.c file of the Linux kernel. An untrusted device can trigger data corruption or loss by supplying a...

PT-2021-6020 · Libgcrypt +9 · Libgcrypt +9

Name of the Vulnerable Software and Affected Versions: Libgcrypt versions prior to 1.9.4 Description: The issue is related to the use of a weak cryptographic algorithm in the Libgcrypt library. It affects the ElGamal implementation, allowing plaintext recovery due to a dangerous combination of th...

PT-2021-17581 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-3 Description: The issue is related to a use after free vulnerability in the file transfer protocol component. This allows remote attackers to execute arbitrary code via unspecifi...

PT-2021-18075 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-3 Description: The issue allows remote attackers to obtain sensitive information via unspecified vectors due to exposure of sensitive information to an unauthorized actor...

Multiple cross-site scripting vulnerabilities in multiple EC-CUBE plugins provided by EC-CUBE

Overview Multiple EC-CUBE plugins provided by EC-CUBE CO.,LTD. contain multiple cross-site scripting vulnerabilities listed below. Cross-site scripting vulnerability CWE-79 - CVE-2021-20742 Cross-site scripting vulnerability CWE-79 - CVE-2021-20743 Cross-site scripting vulnerability CWE-79 -...

PT-2021-4124 · Tor +4 · Tor +4

Name of the Vulnerable Software and Affected Versions: Tor versions prior to 0.4.6.5 Description: An issue was discovered where hashing is mishandled for certain retrieval of circuit data. Consequently, an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm...

PT-2021-16012 · WordPress +1 · Request A Quote +1

Name of the Vulnerable Software and Affected Versions: Request a Quote WordPress plugin versions prior to 2.3.9 Description: The issue is related to authenticated Stored Cross-Site Scripting, which occurs due to the lack of sanitization, validation, or escaping of some settings in the admin...