PT-2021-6804 · Xen +1 · Xen +1

Name of the Vulnerable Software and Affected Versions: Xen affected versions not specified Description: The issue is related to the management of grant table v2 status pages in Xen. When a guest switches from v2 to v1, these pages get de-allocated, but the hypervisor may not correctly track their...

WMS SQL注入漏洞

WMS is a warehouse management software. v1.0 version of WMS has a SQL injection vulnerability, the vulnerability is derived from the GET parameter "id" is passed without filtering, an attacker can use the vulnerability to obtain sensitive database information...

GHSA-6WF9-JMG9-VXCC XStream can cause a Denial of Service

Impact The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation ...

PT-2021-7369 · Unknown · Go-Ethereum

Name of the Vulnerable Software and Affected Versions: go-ethereum versions prior to v1.10.8 Description: A consensus-vulnerability in go-ethereum Geth could cause a chain split, where vulnerable versions refuse to accept the canonical chain. This issue is related to a memory-corruption bug withi...

CVE-2020-22124

A vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information...

joyplus-cms 安全漏洞

joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition, user feedback management, automatic address resolution and message push management and other functions. A security vulnerability exists in the incconfig.php...

CVE-2021-29056

Cross Site Scripting XSS vulnerability exists in Pixelimity 1.0 via the HTTP POST parameter to admin/setting.php...

CVE-2021-34651

The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the /includes/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in...

GPAC Project Advanced Content 安全漏洞

A security vulnerability exists in the MPEG-4 decoding functionality of the GPAC project on Advanced Content library v1.0.1, an open source multimedia framework. The vulnerability stems from the handling of the "hdlr" FOURCC code, where a carefully constructed MPEG-4 input could lead to incorrect...

GPAC 输入验证错误漏洞

GPAC Project on Advanced Content is an open source cross-platform library that implements the MPEG-4 system standard and provides tools for media playback, vector graphics, and 3D rendering.The MPEG-4 decoding feature of GPAC Project on Advanced Content library 1.0.1 suffers from an integer...

GPAC Project Advanced Content 缓冲区错误漏洞

GPAC Project on Advanced Content is an open source cross-platform library that implements the MPEG-4 system standard and provides tools for media playback, vector graphics, and 3D rendering. an integer overflow vulnerability exists in the MPEG-4 decoding functionality in GPAC Project on Advanced...

SINEC NMS 操作系统命令注入漏洞

Siemens SINEC NMS is a network management system NMS from Siemens Germany that is used to centrally monitor, manage, and configure industrial networks with tens of thousands of devices 24/7, including safety-related areas.A security vulnerability exists in versions prior to Siemens SINEC NMS 1.0...

CVE-2021-35312

A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Service.exe" has incorrect permissions, allowing a local unprivileged user to replace it with a malicious file that will be executed with "LocalSystem" privileges...

IgnitedCMS 跨站请求伪造漏洞

Ignited CMS is a content management system CMS. A cross-site request forgery vulnerability exists in IgnitedCMS, which stems from the product /admin/profile/saveprofile failing to validate that a request is from a trusted user. This vulnerability can be exploited to obtain sensitive information a...

CVE-2021-36654

CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter tgo while updating the theme...

RPCMS 跨站脚本漏洞

RPCMS is a software application. A website CMS system. A cross-site scripting vulnerability exists in RPCMS, which stems from the fact that the "Nickname" variable is not properly sanitized before it is displayed on a page in RPCMS v1.8 and below. The vulnerability can be exploited to inject an X...

CVE-2021-25204

Cross-site scripting XSS vulnerability in SourceCodester E-Commerce Website v 1.0 allows remote attackers to inject arbitrary web script or HTM via the subject field to feedbackprocess.php...

CVE-2021-34267

An in the USBHMSCInterfaceInit function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service DOS when the system tries to communicate with the connected endpoint...

CVE-2021-34261

An issue in USBHParseCfgDesc of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system hanging when trying to set a remote wake-up feature...