CVE-2021-23433

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...

CVE-2021-39234

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL...

PT-2021-5279 · Pulse · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R12.1 Description: A vulnerability in Pulse Connect Secure could allow an unauthenticated administrator to cause a denial of service when a malformed request is sent to the device. This issue is relat...

CVE-2021-0198

Improper access control in the firmware for the IntelR Ethernet Network Controller E810 before version 1.5.5.6 may allow a privileged user to potentially enable a denial of service via local access...

PT-2021-23823 · Meddata · Meddata Hbys

Name of the Vulnerable Software and Affected Versions: MedData HBYS versions prior to 1.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

Minio 访问控制错误漏洞

Minio MinIO is an open source object storage server from the US-based MinIO Minio. The product supports building infrastructures for machine learning, analytics, and application data workloads. An access control error vulnerability exists in Minio 0.12.2 and prior versions, which stems from an...

CVE-2021-42847

Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files...

Intel NUC 访问控制错误漏洞

The Intel NUC is a small mini computer from Intel USA. An Access Control Error vulnerability exists in the Intel NUC M15 Laptop Kit driver pack, which stems from a default privilege management error in the product's installer. An attacker could use this vulnerability to cause a denial of service ...

UBUNTU-CVE-2021-43172

NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a new child CA that only consists of anoth...

CVE-2021-43184

In JetBrains YouTrack before 2021.3.21051, stored XSS is possible...

CVE-2021-28023

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths...

WordPress 插件跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site request forgery vulnerability...

Google TensorFlow 数字错误漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A numeric error vulnerability exists in versions of Google TensorFlow prior to 2.7.0, which stems from the fact that AllToAll in TensorFlow performs division by zero when inferring code. No details of t...

CVE-2021-34594

TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system...

CVE-2021-38491

Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. This vulnerability affects Firefox 92...

UBUNTU-CVE-2020-6492

Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

CVE-2021-24789

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

Apache DolphinScheduler SQL注入漏洞

Apache DolphinScheduler is a distributed, decentralized, and easily scalable visual DAG workflow task scheduling platform developed by the Apache Foundation. Dedicated to solving the intricate dependencies in the data processing process and making the scheduling system work out-of-the-box in the...

PT-2021-16195 · WordPress · Flat Preloader

Name of the Vulnerable Software and Affected Versions: Flat Preloader WordPress plugin versions prior to 1.5.4 Description: The issue arises from the lack of nonce checks when saving settings and the failure to sanitise and escape them, which could allow attackers to make logged-in admins change...

Google Chrome 资源管理错误漏洞

A post-release reuse vulnerability exists in "Web Transfer" in versions of Google Chrome prior to 95.0.4638.69, a simple and efficient web browsing tool developed by Google. The vulnerability can be exploited to escape via a carefully crafted HTML surface execution sandbox...