Apache DolphinScheduler SQL注入漏洞

Apache DolphinScheduler is a distributed, decentralized, and easily scalable visual DAG workflow task scheduling platform developed by the Apache Foundation. Dedicated to solving the intricate dependencies in the data processing process and making the scheduling system work out-of-the-box in the...

PT-2021-16195 · WordPress · Flat Preloader

Name of the Vulnerable Software and Affected Versions: Flat Preloader WordPress plugin versions prior to 1.5.4 Description: The issue arises from the lack of nonce checks when saving settings and the failure to sanitise and escape them, which could allow attackers to make logged-in admins change...

Google Chrome 资源管理错误漏洞

A post-release reuse vulnerability exists in "Web Transfer" in versions of Google Chrome prior to 95.0.4638.69, a simple and efficient web browsing tool developed by Google. The vulnerability can be exploited to escape via a carefully crafted HTML surface execution sandbox...

CVE-2021-24608

The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

AZL-6713 CVE-2021-35612 affecting package mysql for versions less than 8.0.28-1

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

AZL-6450 CVE-2021-38297 affecting package golang for versions less than 1.17.8-1

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used...

strongSwan 输入验证错误漏洞

strongSwan is a Swiss Andreas Steffen personal developer of a Linux platform to use the open source IPsec-based VPN solution. The solution includes authentication mechanisms such as X.509 public key certificates, secure storage of private keys, and smart cards. An input validation error...

WordPress 插件 跨站请求伪造漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. A cross-site request forgery vulnerability exists in the WordPress Compact WP Audio Player plugin in versions prior to 1.9.7, which stems from the fact that the web application does not adequatel...

CVE-2021-22963

A redirect vulnerability in the fastify-static module version 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: tru...

CVE-2021-33726

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system allows to download arbitrary files under a user controlled path and does not correctly check if the relative path is still within the intended target directory...

CVE-2021-24656

The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts depending on the settings used, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml...

CVE-2021-35059

OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter...

WordPress 插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin Weather Effect, which stems from the Weather Effect WordPress plugin prior to 1.3.6 not properly validating and escaping some settings e.g. size leaf, flake lea...

CVE-2021-37974

Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page...

UBUNTU-CVE-2021-30626

Out of bounds memory access in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Multipass 安全漏洞

Multipass is a lightweight vm manager for Linux, Windows and MacOS. A security vulnerability exists in Multipass versions for Windows prior to 1.7.0 that allows privilege escalation...

CVE-2021-36366

Nagios XI before 5.8.5 incorrectly allows manageservices.sh wildcards...

CVE-2021-41540

A vulnerability has been identified in Solid Edge SE2021 All versions SE2021MP8. The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process ZDI-CAN-13776...

CVE-2021-37761

Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution...

Asus Rog Armory Crate 代码问题漏洞

Asus Rog Armory Crate is a one-stop application from Asus China Inc. for connecting, configuring and controlling a vast array of Rog gaming products. A security vulnerability exists in Asus Rog Armory Crate Lite versions prior to 4.2.10, which stems from the software previously allowing local use...