Vulnerability fixed in McAfee Agent

McAfee has fixed a vulnerability in McAfee Agent. Due to a flaw in the permissions structure, a local malicious agent can disrupt the operation of Agent by manipulating a directory used by Agent used for temporary files. The result of this is that Agent continues to work, but no longer processes...

PT-2021-12647 · Mcafee · Mcafee Agent

Name of the Vulnerable Software and Affected Versions: McAfee Agent MA for Windows versions prior to 5.7.1 Description: The issue allows local users to block product updates by manipulating a directory used for temporary files, resulting in the product continuing to function with out-of-date...

Fork CMS Authorization Issues Vulnerability

Fork CMS is an open source content management system CMS developed using PHP. The system contains blogs , questions and answers , forms and other modules . A security vulnerability exists in the Admin console in Fork CMS version 5.8.3, which stems from a lack of authentication measures or...

PT-2021-7619 · Unknown +1 · Cgal Libcgal +1

Name of the Vulnerable Software and Affected Versions: CGAL libcgal version 5.1.1 Description: Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code...

PT-2021-7608 · Unknown +1 · Cgal Libcgal +1

Name of the Vulnerable Software and Affected Versions: CGAL libcgal version 5.1.1 Description: Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code...

Marvell QConvergeConsole GUI Authorization Issues Vulnerability

Marvell QConvergeConsole QCC is a unified adapter management software across data centers from Marvell. The software is primarily used for Ethernet and Fibre Channel adapter management, among other things. A security vulnerability exists in the Marvell QConvergeConsole GUI version 5.5.0.74 and...

PT-2021-7596 · Cgal +1 · Cgal Libcgal +1

Name of the Vulnerable Software and Affected Versions: CGAL libcgal version CGAL-5.1.1 Description: The issue is related to the Nef polygon-parsing functionality of CGAL libcgal, where a specially crafted malformed file can lead to an out-of-bounds read and type confusion, potentially resulting i...

mysql: InnoDB unspecified vulnerability (CPU Jan 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

Weiphp 信息泄露漏洞

Weiphp is a WeChat development platform that supports the development of public numbers and small programs by China's Shenzhen Yuanmeng Yun Weiphp company. An information disclosure vulnerability exists in WeiPHP 5.0, which stems from a failure to properly restrict access to pages associated with...

DaDa accelerator 安全漏洞

Ta da Accelerator is a game gas pedal software. A denial of service vulnerability exists in DaDa Accelerator version 5.6.19.816. An attacker could exploit the vulnerability through a specially crafted program to cause a computer crash...

Western Digital Western Digital My Cloud Authorization Issues Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. An authorization issue vulnerability exists in Western Digital My Cloud OS 5 devices prior to version 5.06.115, where due to insufficient validation of URI paths, a NAS management authentication bypass vulnerability...

hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized...

sokrates Sokrates SOWA SowaSQL Cross-Site Scripting Vulnerability

sokrates Sokrates SOWA SowaSQL is an administrative database applied to the library environment by the Polish company sokrates. A cross-site scripting vulnerability exists in Sokrates SOWA SowaSQL version 5.6.1 and earlier versions, which originates from the sowacgi.php typ parameter, OPAC is...

CVE-2020-22394

In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting XSS vulnerability...

Cybozu Garoon vulnerable to improper input validation

Overview Cybozu Garoon provided by Cybozu, Inc. contains an improper input validation vulnerability CWE-20. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early Warning...

kernel: sync of excessive duration via an XFS v5 image with crafted metadata

A flaw was discovered in the XFS source in the Linux kernel. This flaw allows an attacker with the ability to mount an XFS filesystem, to trigger a denial of service while attempting to sync a file located on an XFS v5 image with crafted metadata...

XSS Vulnerability in CUPCMS v5.0 Frontend

CUPCMS v5.0 cup content management system integrates video, stars, news, comics, community and more. An XSS vulnerability exists in the frontend of CUPCMS v5.0, which can be exploited by attackers to obtain sensitive information from user cookies...

EyesOfNetwork eonweb Arbitrary OS Command Execution Vulnerability

EyesOfNetwork "EON" is the open source and free IT monitoring solution that combines practical ITIL processes with a technical interface that allows its workday program. eonweb is the web interface for EyesOfNetwork. An arbitrary operating system command execution vulnerability exists in...

CVE-2020-27533

A Cross Site Scripting XSS issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages...

Nagios XI Cross-Site Request Forgery Vulnerability

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. Nagios XI version 5.7.3 suffers from a cross-site request forgery vulnerability that can be exploited by...