CVE-2021-35977

creationtimestamp| type| source ---|---|--- 2021-10-08 18:40:15+00:00| seen| https://t.me/cibsecurity/30249...

Samsung SMR 路径遍历漏洞

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A path traversal vulnerability exists in versions prior to Samsung SMR Oct-2021 Release 1, which stems from a path traversal vulnerability in FactoryAirCommnadManger, which allows ...

Design/Logic Flaw

The Stripe for WooCommerce WordPress plugin is missing a capability check on the save function found in the /includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases...

CVE-2021-39347 Stripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account Hijacking

The Stripe for WooCommerce WordPress plugin is missing a capability check on the save function found in the /includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases...

GitLab 信息泄露漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

CVE-2021-40378

creationtimestamp| type| source ---|---|--- 2021-09-21 04:41:53+00:00| seen| https://t.me/pwnwikizhchannel/842...

OnyakTech Comments Pro 信任管理问题漏洞

OnyakTech Comments Pro has been building DNN modules since 2003. A trust management issue vulnerability exists in OnyakTech Comments Pro that stems from a hard-coded username and user ID issue in the comment post request function. The vulnerability allows an attacker to control the username of a...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based, fully distributed operating system. Huawei HarmonyOS has a security vulnerability that could be exploited by attackers to isolate and read synchronization files from other applications via UID sandboxing...

CVE-2021-33338

creationtimestamp| type| source ---|---|--- 2021-08-04 19:24:33+00:00| seen| https://t.me/cibsecurity/26817...

DELL Dell EMC Isilon OneFS 和 EMC PowerScale 安全漏洞

DELL Dell EMC Isilon OneFS and EMC PowerScale are both a set of horizontally scalable storage systems for unstructured data from Dell USA. A security vulnerability exists in Dell Isilon OneFS 8.2.2 and prior versions and Dell EMC PowerScale OneFS 9.0.0 and prior versions. The vulnerability stems...

Motorola CX2 授权问题漏洞

The Motorola CX2 is a wireless router from Motorola. An authorization issue vulnerability exists in the Motorola CX2 router, which stems from the lack of an effective privilege control mechanism in the product's login.html. The vulnerability can be exploited to bypass login and obtain an authoriz...

polkit 代码问题漏洞

polkit is a component for controlling system-wide permissions in Unix-like operating systems. It enables communication between processes of different priority by defining and auditing permission rules. A code issue vulnerability exists in polkit that stems from the inability of a requesting proce...

Nextcloud 安全漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server that can be exploited by an attacker to send a user ID to a lookup server when the user is not set to a...

红帽 Red Hat Ceph 授权问题漏洞

Red Hat Ceph is a Linux petabyte-level distributed file system from Red Hat. The main goal of the system is to be designed as a distributed file system without a single point of failure, based on POSIX Portable Operating System Interface, enabling fault-tolerant and seamless data replication. cep...

PT-2021-10412 · Shopxo · Shopxo

Name of the Vulnerable Software and Affected Versions: Shopxo versions 1.4.0 through 1.5.0 Description: The issue allows remote attackers to gain privileges by manipulating the user id parameter in the HTML request to the "/index.php" endpoint. Recommendations: For versions 1.4.0 through 1.5.0, a...

OESA-2021-1101 dbus security update

D-Bus is a message bus system, a simple way for applications to talk to one another. In addition to interprocess communication, D-Bus helps coordinate process lifecycle; it makes it simple and reliable to code a "single instance" application or daemon, and to launch applications and daemons on...

PYSEC-2021-31

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information...

CVE-2021-26898

creationtimestamp| type| source ---|---|--- 2021-03-11 18:54:53+00:00| seen| https://t.me/cibsecurity/24777...

CVE-2021-3124

creationtimestamp| type| source ---|---|--- 2021-02-25 18:37:53+00:00| seen| https://t.me/cibsecurity/24136...

CVE-2019-18642

Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature. The lack of validation and use of sequential user IDs allows any user to change account details of any other user. This vulnerability could be used to change the...