CVE-2021-3313

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and...

The vulnerability of the Adobe Animate software for creating multimedia and computer animations lies in its ability to read data beyond the boundaries of the memory buffer. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Adobe Animate program for creating multimedia and computer animations is related to reading beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information in the context of the current user, usin...

Nextcloud: User deletion is not handled properly everywhere

So I came across this when going over https://nextcloud.com/compare/ And noticed the section: "BUILT IN DATA-REQUEST/ACCOUNT DELETION" However looking at this it seems this is not handled properly everywhere in Nextcloud. I understand that the GDPR etc do consider shared data differently. For...

Code injection

There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin...

Hashicorp Nomad 安全漏洞

Hashicorp Nomad is a distributed, data center-aware cluster and application scheduler from Hashicorp, USA. The program supports the deployment of microservices, batch, containerized and non-containerized applications. Nomad suffers from a security vulnerability that stems from the mishandling of...

CVE-2021-27396

A vulnerability has been identified in Tecnomatix Plant Simulation All versions V16.0.5. The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a stack based buffer overflow, a different vulnerability than CVE-2021-27398. An attacke...

Fixed in Apache Tomcat 8.5.66

Low: Authentication weakness CVE-2021-30640 Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data eg user names as well as configuration data provided by an administrator. In limited circumstances it was possible for...

Foxit Reader Code Execution Vulnerability

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A code execution vulnerability exists in Foxit Reader. The vulnerability stems from the program's lack of proper validation of user-supplied data. An attacker can exploit this vulnerability to execute code in the context of th...

CVE-2020-24586

The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require that received fragments be cleared from memory after reconnecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using...

CVE-2020-24586

The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require that received fragments be cleared from memory after reconnecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using...

CVE-2020-24586

The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require that received fragments be cleared from memory after reconnecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using...

CVE-2020-24586

The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require that received fragments be cleared from memory after reconnecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using...

Foxit Reader U3D File Parsing Out-of-Bounds Read Remote Code Execution Vulnerability (CNVD-2021-36467)

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A security vulnerability exists in Foxit Reader U3D file parsing, which stems from the lack of proper validation of user-supplied data, which could lead to reading more than the end of the allocated object. An attacker can...

Foxit Reader app.media Remote Code Execution Vulnerability

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A security vulnerability exists in Foxit Reader app.media. The vulnerability stems from a lack of proper validation of user-supplied data. An attacker can exploit this vulnerability by tricking a user into visiting a malicious...

Foxit Reader Code Execution Vulnerability (CNVD-2021-38097)

Foxit Reader old name: Foxit PDF Reader is a set of software used to read PDF format files, by Fujian Foxit Software developed by Foxit Reader is a set of free to use the software, the operating system is mainly based on Microsoft Windows, and as long as there is a Win32 implementation of the...

Foxit Reader U3D File Parsing Out-of-Bounds Read Remote Code Execution Vulnerability

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A security vulnerability exists in Foxit Reader U3D file parsing, which stems from the lack of proper validation of user-supplied data, which could lead to reading more than the end of the allocated object. An attacker can...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2021-36198)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Firefox for Android suffers from a cross-site scripting vulnerability that stems from insufficient innocent handling of user-supplied data. No details of the vulnerability are provided at this time...

Facebook bans Signal ads that reveal the depth of what it knows about you

Most of our readers are well aware of the fact that the big tech corporations, especially those that run social media know a great deal about us and our behavior. But it rarely hits home how much personal data they have about us and how they can guess, quite correctly, even more. Lots more. Signa...

Anti-Spam WordPress Plugin Could Expose Website User Data

An SQL-injection vulnerability discovered in a WordPress plugin called “Spam protection, AntiSpam, FireWall by CleanTalk” could expose user emails, passwords, credit-card data and other sensitive information to an unauthenticated attacker. Spam protection, AntiSpam, FireWall by CleanTalk is...

Parallels Desktop Tools Integer Overflow Elevation of Privilege Vulnerability (CNVD-2021-34188)

Parallels Desktop is a virtual machine software that runs on Mac computers. A security vulnerability exists in the Parallels Tools component of Parallels Desktop version 16.1.2-49151. The vulnerability stems from a lack of proper validation of user-supplied data. An attacker can exploit the...