CVE-2021-42369

Imagicle Application Suite for Cisco UC before 2021.Summer.2 allows SQL injection. A low-privileged user could inject a SQL statement through the "Export to CSV" feature of the Contact Manager web GUI...

CVE-2021-42369

Imagicle Application Suite for Cisco UC before 2021.Summer.2 allows SQL injection. A low-privileged user could inject a SQL statement through the "Export to CSV" feature of the Contact Manager web GUI...

CVE-2021-22035

VMware vRealize Log Insight 8.x prior to 8.6 contains a CSVComma Separated Value injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log...

Vmware VMware vRealize Log Insight Injection Vulnerability

VMware vRealize Log Insight is a centralized log management solution from Vmware, Inc. VMware vRealize Log Insight is vulnerable to a CSV injection vulnerability that allows an authenticated attacker to embed untrusted data through CSV tables...

CVE-2021-41136

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a...

CVE-2021-41136

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a...

SAP Business One security vulnerabilities

SAP Business One is a suite of enterprise management software from SAP, a German company. SAP Business One version 10.0 is vulnerable to CSV injection, which can be exploited by attackers to execute arbitrary commands on a victim's computer...

CVE-2021-41128

Hygeia is an application for collecting and processing personal and case data in connection with communicable diseases. In affected versions all CSV Exports Statistics & BAG MED contain a CSV Injection Vulnerability. Users of the system are able to submit formula as exported fields which then get...

Pterodactyl Authorization Issue Vulnerability

Pterodactyl is an open source game server administration panel built using PHP, Nodejs and Go. Pterodactyl suffers from a security vulnerability that allows a malicious user to modify the content of the confirmationtoken input during the two-factor authentication process to refer to cached values...

CVE-2021-33849

A Cross-Site Scripting XSS attack can cause arbitrary code JavaScript to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application's users and not the application itself while using your application as the attack's vehicle. The XSS payload...

CVE-2021-33849: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS attack can cause arbitrary code JavaScript to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application's users and not the application itself while using your application as the attack's vehicle. The XSS payload...

Zephyr security vulnerabilities

Zephyr is an open source, small, scalable, real-time operating system. a security vulnerability exists in Zephyr, which stems from the use of incorrect values for buffer access. No details of the vulnerability are currently available...

Multiple Qualcomm product vulnerabilities involving buffer errors

Qualcomm SD 636 and others are products of Qualcomm Incorporated Qualcomm.SD 636 is a central processing unit CPU product.SDM630 is a central processing unit CPU product.APQ8017 is a central processing unit CPU product. A buffer error vulnerability exists in Qualcomm that stems from a lack of...

Redis Labs Redis security vulnerabilities

Redis Labs Redis is an open source, ANSI C, network-enabled, memory-based, persistent logging, key-value Key-Value storage database from Redis Labs, Inc. that provides APIs in multiple languages. A security vulnerability exists in Redis where, when parsing an incoming Redis Standard Protocol RESP...

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

CVE-2021-41829: Use of Insufficiently Random Values

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key...

Approximations may finish with inaccurate values

Handle 0xsanson Vulnerability details Impact In HybridPool.sol, functions computeLiquidityFromAdjustedBalances, getY and getYD may finish before approximation converge, since it's limited by MAXLOOPLIMIT iterations. In this situation the final estimated value will still be treated as correct, eve...

PT-2021-16884 · Suitecrm · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions 7.10.29 through 7.10.31 SuiteCRM versions 7.11.18 through 7.11.19 Description: The issue concerns a CSV Injection vulnerability, also known as Formula Injection, which allows a low-privileged attacker to inject payloads into...

IndexPool initial LP supply computation is wrong

Handle cmichel Vulnerability details The IndexPool.constructor function already mints INITPOOLSUPPLY = 100 1e18 = 1e20 LP tokens to the zero address. When trying to use the pool, someone has to provide the actual initial reserve tokens in mint. On the first mint, the pool reserves are zero and th...

GHSA-5VCM-3XC3-W7X3 Response Splitting from unsanitized headers

Impact http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå Header values Header.value Status reason phrases Status.reason URI paths Uri.Path URI authority registered names...