A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.

...

CVE-2021-23896

Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security DBSec prior to 4.8.2 allows an administrator to view the unencrypted password of the McAfee Insights Server used to pass data to the Insights Server. This user is restricted to...

CVE-2021-24317

The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues...

CVE-2021-29090

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors...

PT-2021-15855 · WordPress · Listeo

Name of the Vulnerable Software and Affected Versions: Listeo WordPress theme versions prior to 1.6.11 Description: The issue allows any authenticated users to delete arbitrary pages/posts and bookings via an IDOR vector because it does not ensure that the post/page and booking to be deleted belo...

WordPress 插件 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . Funnel Builder by CartFlows - Create High Converting Sale...

Synology Photo Station 代码问题漏洞

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology Inc. of Taiwan, China. A file upload vulnerability exists in Synology Photo Station versions prior to 6.8.14-3500, which originates from an unrestricted upload of a file with a dangerous ty...

Nextcloud 访问控制错误漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An access control error vulnerability exists in Nextcloud Mail versions prior to 1.4.3, and prior to 1.8.2, which can be exploited by an authenticated attacke...

PT-2021-15867 · Cartflows · The Funnel Builder By Cartflows

Name of the Vulnerable Software and Affected Versions: The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin versions prior to 1.6.13 Description: The issue concerns the plugin's failure to sanitize its facebook pixel id and google analytics id settings,...

DEBIAN-CVE-2021-29505

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to...

CVE-2020-10716

A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects...

CVE-2021-22907

An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions prior to 2105 and 1912 LTSR prior to CU4...

CODESYS V2 Web-Server 缓冲区错误漏洞

3S-Smart Software Solutions CODESYS V2 Web-Server is an application from 3S-Smart Software Solutions, Germany. A web server. A buffer overflow vulnerability exists in 3S-Smart Software Solutions CODESYS V2 Web-Server versions prior to 1.1.9.20, which can be exploited by an attacker with the help ...

Checkbox Survey 代码问题漏洞

Checkbox Survey is an ASP.NET application from Checkbox Survey. A code issue vulnerability exists in Untrusted Data in CheckboxWeb.dll in versions prior to Checkbox Survey 7. The vulnerability allows an unauthenticated, remote attacker to execute arbitrary code...

Google Chrome资源管理错误漏洞

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A double-release vulnerability exists in ICU in versions prior to Google Chrome 91.0.4472.77, which can be exploited by a remote attacker to potentially exploit hea...

CVE-2021-24306

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue...

Red Hat libvirt 缓冲区错误漏洞

Red Hat libvirt is a Linux API for implementing Linux virtualization features from Red Hat, Inc. It supports a variety of Hypervisors, including Xen and KVM, as well as QEMU and a number of virtual products for other operating systems. A denial of service vulnerability exists in the...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WooCommerce WordPress plugin for PickPlugins Product slider...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Autoptimize WordPress plugin prior to...

ronomon 命令注入漏洞

ronomon is open source a fast and powerful encoder/decoder for RFC 2045 and RFC 2047. Used for buffers in pure Javascript with optional C ++ bindings. A command injection vulnerability exists in ronomon/opened library versions prior to 1.5.2, which can be exploited by remote attackers to execute...