Cross site request forgery (csrf)

Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, that - when visited, allows them control of the list control panel as if the bad actor was logged in themselves. This includes changing any...

WordPress Live Search for WooCommerce plugin <= 1.3.1 - Multiple vulnerabilities

Multiple vulnerabilities Authenticated Arbitrary WordPress Options Change, Read and Deletion / Authenticated User Enumeration / Authenticated Plugin Settings Change, Import and Export were discovered by Jerome Bruandet NinTechNet in WordPress Live Search for WooCommerce plugin versions = 1.3.1...

WordPress Add Product Tabs for WooCommerce plugin <= 1.4.1 - Multiple vulnerabilities

Multiple vulnerabilities Authenticated Arbitrary WordPress Options Change, Read and Deletion / Authenticated User Enumeration / Authenticated Plugin Settings Change, Import and Export were discovered by Jerome Bruandet NinTechNet in WordPress Add Product Tabs for WooCommerce plugin versions =...

CVE-2021-39215

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue...

CVE-2021-39215

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue...

PT-2021-6865 · Adobe · Acrobat 2020 +5

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat versions prior to 2021.005.20060 Adobe Acrobat Reader versions prior to 2021.005.20060 Adobe Acrobat 2017 versions prior to 2017.011.30199 Adobe Acrobat Reader 2017 versions prior to 2017.011.30199 Adobe Acrobat 2020 versions...

Docker < 1.2.1 Container Override Vulnerability

Container names in Docker may collide with and override container IDs. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Docker < 1.3.0 Image Redirect Vulnerability

Docker is prone to a vulnerability regarding image IDs. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

Docker < 1.3.2 Privilege Escalation Vulnerability

Docker is prone to a privilege escalation vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

PT-2021-18249 · October · October/System

Name of the Vulnerable Software and Affected Versions: october/system package versions prior to v1.1.5 october/system package versions prior to Build 472 Description: The issue allows an attacker to bypass authentication and take over a user account on an October CMS server. This can be exploited...

CVE-2021-39157

detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in detect-character-encoding v0.7.0. No workaround are available and all...

PT-2021-19038 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15 iPadOS versions prior to 15 Description: An access issue was addressed with improved access restrictions. An attacker in a privileged network position may be able to leak sensitive user information. Recommendations: F...

PT-2021-19036 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.6 iPadOS versions prior to 14.6 Description: The issue was addressed with improved permissions logic. A user may be unable to fully delete browsing history. Recommendations: For iOS versions prior to 14.6, update to i...

PT-2021-8247 · Apple · Macos Monterey +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.1 macOS Big Sur versions prior to 11.6.2 Description: A logic issue was addressed with improved state management, allowing a malicious application to bypass Privacy preferences. This issue may lead to data leakage. ...

PT-2021-22564

Name of the Vulnerable Software and Affected Versions: GNOME libgfbgraph versions prior to 0.2.5 Description: The issue is related to the lack of TLS certificate verification in the SoupSessionSync objects created by gfbgraph-photo.c, making users susceptible to network man-in-the-middle MITM...

PT-2021-7414 · Redmine · Redmine

Name of the Vulnerable Software and Affected Versions: Redmine versions 4.1.5 and earlier Redmine versions 4.2.x before 4.2.3 Description: The issue is related to an insufficient access filter, which may disclose the names of users on activity views. This allows a remote attacker to access...

KLA12265 DoS vulnerability in Mozilla Firefox

Header splitting vulnerability was found in Mozilla Firefox. Malicious users can exploit this vulnerability to cause denial of service. Original advisories MFSA2021-37 Exploitation Related products Mozilla-Firefox CVE list CVE-2021-29991 unknown Solution Update to the latest version Download...

PT-2021-21826 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.4.3.1 Description: The issue is related to a command injection vulnerability in mail agent settings. This vulnerability affects Shopware, an open source eCommerce platform. There is no information provided about t...

OpenSSL: Timing-based attacks on SSL/TLS with CBC encryption (CVE-2003-0078) - Linux

OpenSSL is prone to timing-based attacks on SSL/TLS with CBC encryption. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...

OpenSSL: Multiple Vulnerabilities (20080528) - Windows

OpenSSL is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...