SOGo 数据伪造问题漏洞

SOGo is a very fast and scalable modern collaboration suite. It provides calendaring, address book management and a full-featured Webmail client, as well as resource sharing and permission handling. A security vulnerability exists in SOGo that stems from the fact that when the program's SAML is t...

CVE-2021-28812

A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2; versions prior to 5.5....

PT-2021-17103 · Unknown · Merge-Deep

Name of the Vulnerable Software and Affected Versions: merge-deep library versions prior to 3.0.3 Description: The issue allows an attacker to trick the library into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in t...

UBUNTU-CVE-2021-29966

Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 89...

WordPress 插件 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

Nginx 控制器 安全漏洞

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in F5 NGINX Controller that stems from the fact that intra-cluster communication do...

PT-2021-20792 · Unknown · Kiali-Operator

Name of the Vulnerable Software and Affected Versions: kiali-operator versions prior to 1.33.0 kiali-operator versions prior to 1.24.7 Description: An incorrect access control flaw was found in the kiali-operator. This flaw allows an attacker with a basic level of access to the cluster to deploy ...

Roomer 授权问题漏洞

Roomer is a discord bot cog extension. It provides automatic voice channel generation as well as private voice and text channels. There is an authorization issue vulnerability in Roomer versions prior to 1.0.1, no detailed vulnerability details are provided at this time...

CVE-2021-22907

An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions prior to 2105 and 1912 LTSR prior to CU4...

CVE-2020-25724

A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected...

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality integrity and availability.

...

A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

...

Apple iPadOS 资源管理错误漏洞

iOS is a mobile operating system developed by Apple. iPadOS is a family of mobile operating systems developed by Apple based on iOS. Apple iPadOS and iPadOS versions prior to 14.6 have a post-release reuse vulnerability that stems from a post-release use when handling email messages in the Mail...

CVE-2018-25012

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24...

libwebp 资源管理错误漏洞

Libwebp is a WebP image format encoding and decoding library . A buffer overflow vulnerability exists in Libwebp versions prior to 1.0.1, which stems from libwebp allocating too much memory when reading a file and can be exploited by an attacker to cause a service crash...

Zope 路径遍历漏洞

Zope is a set of object-oriented, open source web application servers written in the Python language by the Zope ZOPE community. A security vulnerability exists in Zope in versions prior to 4.6 and 5.2 that allows untrusted users to trigger the vulnerability by adding sites that edit Zope page...

libwebp 安全漏洞

Libwebp is a WebP image format encoding and decoding library . A security vulnerability exists in versions of Libwebp prior to 1.0.1. The vulnerability stems from the use of a single variable in the ReadSymbol function. An attacker could exploit the vulnerability to threaten data confidentiality...

pajbot 跨站请求伪造漏洞

pajbot is a software application. A twitch chatbot. A cross-site request forgery vulnerability exists in versions prior to Pajbot 1.52, which stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could exploit the vulnerability to...

Red Hat Wildfly 跨站脚本漏洞

Red Hat Wildfly is the United States Red Hat Red Hat, Inc. of a lightweight JavaEE-based open source application server . A cross-site scripting vulnerability exists in Red Hat Wildfly versions prior to 23.0.2. An attacker can exploit this vulnerability by adding a payload to the name field to...

CVE-2021-3426

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to...