CVE-2021-33015

Cscape All Versions prior to 9.90 SP5 lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write via an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process...

CVE-2021-30962

A memory initialization issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Big Sur 11.6.2. Parsing a maliciously crafted audio file may lead to disclosure of user information...

CVE-2021-30960

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2, tvOS 15.2. Parsing a maliciously crafted audio file may lead to disclosure of user information...

Apple macOS Big Sur 缓冲区错误漏洞

Apple macOS Big Sur is a mobile application app from Apple USA Inc. Apple macOS Big Sur CoreAudio suffers from a buffer error vulnerability that originates from parsing maliciously crafted audio files that could lead to the disclosure of user information. The following products and versions are...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for the iPad tablet computer. Apple iOS and Apple iPadOS contain a security vulnerability that originated when an attacker with a privileged...

Apple tvOS 缓冲区错误漏洞

Apple tvOS is a set of smart TV operating systems from the American company Apple Apple. A buffer error vulnerability exists in a number of Apple products, where an attacker may be able to disclose user information through a maliciously crafted file. The issue is fixed in iOS 15.1 and iPadOS 15.1...

PT-2021-8247 · Apple · Macos Monterey +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.1 macOS Big Sur versions prior to 11.6.2 Description: A logic issue was addressed with improved state management, allowing a malicious application to bypass Privacy preferences. This issue may lead to data leakage. ...

Apple tvOS和Apple macOS Big Sur 安全漏洞

Apple tvOS and Apple macOS Big Sur are both products of Apple Inc. Apple tvOS is a smart TV operating system. apple macOS Big Sur is the 17th major version of macOS, Apple's operating system for the MAC. macOS Big Sur is the 17th major version of macOS, Apple's operating system for the MAC. A...

Microsoft Spills 38 Million Sensitive Data Records Via Careless Power App Configs

For months, Microsoft’s Power Apps portals exposed personal data tied to 38 million records ranging from COVID-19 vaccination status, Social Security numbers and email addresses. Consumers most affected by what is being called a “platform issue” are those doing business with American Airlines,...

Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure

The plugin outputs the Hashed Password, Username and Email Address along other less sensitive data of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the editposts capability. Combined with the other Unauthorised Event...

LY Corporation: Improper authorization allows disclosing users' notification data in Notification channel server

LINE Channel authentication provides separate authentication tokens for each LINE Channel. Due to the bug in the authentication process in the Notifications Channel service, it could be possible for an attacker to get the Notifications Channel data of another user by using their valid...

Discourse 2.8.0.beta5 Security Update

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

COVID19 Testing Management System 1.0 - Multiple SQL Injections Vulnerabilities

Exploit Title: COVID19 Testing Management System 1.0 - 'Multiple' SQL Injections Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/ Version: V1 Category: Webapps Tested on:...

Mitel Networks MiCollab Directory Traversal Vulnerability

Mitel Networks MiCollab is a mobile application from Mitel Networks Canada that provides voice, video, messaging, audio conferencing and team collaboration for employees.A security vulnerability exists in versions of Mitel Networks MiCollab prior to 9.2 FP2, which could be exploited by an...

CVE-2021-3352

The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unauthenticated attacker to access view and modify user data without authorization due to improper handling of tokens...

CVE-2021-27402

The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access view and modify user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal...

CVE-2021-37703

Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user's read state for a topic such as the last read post number and the notification level is exposed...

CVE-2021-27401

The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access view and modify user data by executing arbitrary code due to insufficient input validation, aka Cross-Site Scripting XSS...

CVE-2021-3352

The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unauthenticated attacker to access view and modify user data without authorization due to improper handling of tokens...

CVE-2021-27402

The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access view and modify user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal...