Xiaomi community 安全漏洞

Xiaomi Community, an official user community application of Xiaomi, China, is vulnerable to an authorization issue in versions prior to 3.0.210809, which stems from the exposure of some js interfaces. An attacker could use this vulnerability to maliciously invoke sensitive functions...

CVE-2021-24510

The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue...

PT-2021-22882 · Playsms · Playsms

Name of the Vulnerable Software and Affected Versions: playSMS versions prior to 1.4.5 Description: The issue allows for Arbitrary Code Execution by entering PHP code at the tabs-information-page of core main config, and then executing that code via the "index.php?app=main&inc=core welcome" URI...

UBUNTU-CVE-2021-39256

A crafted NTFS image can cause a heap-based buffer overflow in ntfsinodelookupbyname in NTFS-3G 2021.8.22...

UBUNTU-CVE-2021-39261

A crafted NTFS image can cause a heap-based buffer overflow in ntfscompressedpwrite in NTFS-3G 2021.8.22...

AZL-6751 CVE-2021-33289 affecting package ntfs-3g for versions less than 2021.8.22-1

In NTFS-3G versions 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution...

CVE-2021-39261

A crafted NTFS image can cause a heap-based buffer overflow in ntfscompressedpwrite in NTFS-3G 2021.8.22...

WordPress plugin AddToAny Share Buttons 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in WordPress plug...

Pillow 缓冲区错误漏洞

Pillow is a Python based image processing library. A buffer error vulnerability exists in the pillow module in python prior to version 8.3.2, which stems from improper design or implementation during code development for a networked system or product, and can be exploited by an attacker to cause ...

CVE-2021-33938

Buffer overflow vulnerability in function prunetorecommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial of Service...

Unitrends Backup 安全漏洞

Unitrends Backup is a set of data protection software from Unitrends, Inc. in the United States. The software provides data backup, data recovery and deduplication features. A remote code execution vulnerability exists in Unitrends Backup versions prior to 10.5.5-2, which can be exploited by an...

total.js 代码注入漏洞

total.js is open source a framework developed using JavaScript for the Node.js platform. It can be used to develop web, desktop, service and IoT platforms. Total.js suffers from a code injection vulnerability that stems from a call to the utils.set function with a user-controlled value in the...

CVE-2021-40147

EmTec ZOC before 8.02.2 allows \e201 pastes, a different vulnerability than CVE-2021-32198...

CVE-2021-37153

ForgeRock Access Management AM before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue...

CVE-2021-33882

A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

GNU Zint Barcode Generator 缓冲区错误漏洞

GNU Zint Barcode Generator is a GNU open source application. It is used to generate bar? A security vulnerability exists in GNU Zint Barcode Generator versions prior to 2.10.0, which arises from an improperly designed or implemented code development process for a networked system or product...

CVE-2021-22936

A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter...

CVE-2021-24512

The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting XSS vulnerability in one of the administrative functions for handling deletion of videos...

CVE-2021-24526

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue...