CVE-2021-32656

Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added a...

CVE-2021-32656

Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added a...

Spoofing

Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added a...

PT-2021-19834 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 19.0.11 Nextcloud Server versions prior to 20.0.10 Nextcloud Server versions prior to 21.0.2 Description: A vulnerability in federated share exists in Nextcloud Server, allowing an attacker to gain access to...

OnePlus8T has an information leak vulnerability

The OnePlus 8T is a smartphone. OnePlus8T has an information disclosure vulnerability. An attacker can exploit to obtain sensitive user information...

Unauthorized Access Vulnerability in IoT Smart Water Meter Supervision Platform of Shandong KDE Electronics Co.

IOT Smart Water Meter Supervision Platform is a smart water meter monitoring platform developed by Shandong KD Electronics Co., Ltd. with the functions of water account opening, bill payment management, data reporting and water meter management. Ltd. There is an unauthorized access vulnerability ...

CVE-2021-33561

A stored cross-site scripting XSS vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customername in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when informati...

GHSA-Q9P8-33WC-H432 Authenticated users can exploit an enumeration vulnerability in Harbor

Impact Hidde Smit from Cyber Eagle has discovered an User Enumeration flaw in Harbor. The issue is present in the "/users" api endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained via the "search"...

About the security content of macOS Big Sur 11.4

About the security content of macOS Big Sur 11.4 This document describes the security content of macOS Big Sur 11.4. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

About the security content of iOS 14.6 and iPadOS 14.6

About the security content of iOS 14.6 and iPadOS 14.6 This document describes the security content of iOS 14.6 and iPadOS 14.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

About the security content of Safari 14.1.1

About the security content of Safari 14.1.1 This document describes the security content of Safari 14.1.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

UPchieve: Cross-origin resource sharing misconfig | steal user information

Summary An HTML5 cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features ...

CVE-2021-30167

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices...

CVE-2021-30167 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices...

About the security content of macOS Big Sur 11.3

About the security content of macOS Big Sur 11.3 This document describes the security content of macOS Big Sur 11.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

About the security content of tvOS 14.5

About the security content of tvOS 14.5 This document describes the security content of tvOS 14.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Weak Password Vulnerability in Fusion Router FR3008

Ltd. was founded in 2009, is to provide users with intelligent products and cloud services in the field of smart home technology innovative enterprises Smart Life is Fusion's Internet strategy segment, with intelligent network devices, smart hardware, APP and Internet communication channels as th...

Debian DLA-2625-1 : courier-authlib security update

The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's...

CVE-2021-28938

Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x before 7.6.2-20.2, 7.7.x through 7.9.x before 7.9.3-21.6, 7.10.x before 7.10.2-22.2, and 7.11.x before 7.11.2-23.0 can leak user information across thread contexts. This occurs in opportunistic circumstances when there is concurrent query...

CVE-2021-28938

Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x before 7.6.2-20.2, 7.7.x through 7.9.x before 7.9.3-21.6, 7.10.x before 7.10.2-22.2, and 7.11.x before 7.11.2-23.0 can leak user information across thread contexts. This occurs in opportunistic circumstances when there is concurrent query...