Horner Automation Cscape 缓冲区错误漏洞

Cscape is an application that can program the full range of OCS. A memory corruption vulnerability exists in Cscape versions prior to 9.90 SP4. The vulnerability stems from the affected application failing to properly validate user-supplied data when parsing a project file. An attacker can exploi...

GPAC 缓冲区错误漏洞

GPAC is a multimedia framework for rich media and distributed under the LGPL license. A heap buffer overflow vulnerability exists in the abstboxread function in boxcodeadobe.c in versions of GPAC prior to 1.0.1. No detailed vulnerability details are provided at this time...

PT-2021-11191 · Hashicorp +2 · Hashicorp Consul +3

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise versions prior to 1.9.5 HashiCorp Consul and Consul Enterprise versions prior to 1.8.10 HashiCorp Consul and Consul Enterprise versions prior to 1.7.14 Description: The issue concerns a cross-site...

GStreamer 资源管理错误漏洞

GStreamer is an open source multimedia framework library . Use it to build a range of media processing modules , including from simple ogg playback functions to complex audio mixing and video non-linear editing processing . A post-release reuse vulnerability exists in versions of GStreamer prior ...

Mozilla: Thunderbird might execute an alternative OTR library

When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distributed by Thunderbird. If a computer has already been infected with a malicious library of the alternative filename, and the malicious...

Mozilla: Logic issue potentially leaves key material unlocked

Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may remain in memory in its unprotected state. This vulnerability affects Thunderbird 78.8.1...

Zulip 访问控制错误漏洞

Zulip server is an open source team chat application from the American company Zulip. An Access Control Error vulnerability exists in versions of Zulip Server prior to 3.4, which results in a user with this privilege being able to send messages. No details of the vulnerability are provided at thi...

Google Chrome 访问控制错误漏洞

Chrome is a web browsing tool developed by Google. A security vulnerability exists in Google Chrome versions prior to 90.0.4430.72. A remote attacker can leak cross-origin data through a carefully crafted HTML page...

Gradle 安全漏洞

Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A security vulnerability exists in Gradle versions prior to 7.0 that allows multiple users to create system temporary directories by creating and deleting open permissions to fil...

Pillow 安全漏洞

Pillow is a Python-based image processing library. a denial of service vulnerability exists in versions prior to Pillow 8.2.0, which stems from the fact that for FLI data, FliDecode does not properly check whether the block advance is non-zero, and an attacker can exploit this vulnerability to...

WordPress 插件 跨站脚本漏洞

Patreon is a subscription-based crowdfunding platform and Patreon WordPress is a WordPress plugin for the platform. A cross-site scripting vulnerability exists in the login form in Patreon WordPress versions prior to 1.7.2. An attacker can exploit this vulnerability to conduct cross-site scriptin...

Nagios SQL注入漏洞

Nagios Network Analyzer is a network data flow analyzer that provides a view of all network traffic and bandwidth utilization. A SQL injection vulnerability exists in Nagios Network Analyzer versions prior to 2.4.3. The vulnerability can be exploited to read sensitive data from the database and...

Adrian indico 安全漏洞

Adrian indico is an application of Adrian open source . A hierarchical content management system. A security vulnerability exists in versions prior to Adrian indico 2.3.4, which stems from the ability to use an attacker-supplied host header in a password reset link...

CVE-2021-22158

The Proofpoint Insider Threat Management Server formerly ObserveIT Server is vulnerable to XML external entity XXE injection in the Web Console. The vulnerability requires admin user privileges and knowledge of the XML file's encryption key to successfully exploit. All versions before 7.11 are...

Design/Logic Flaw

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using tar. If one of those layers is not a valid tar archive this causes an error leading to an unexpected situation where the code...

DEBIAN-CVE-2021-20234

An uncontrolled resource consumption memory leak flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client that connects to multiple malicious or compromised servers to crash. The highest threat from this vulnerability is to system availability...

CVE-2021-20235

There's a flaw in the zeromq server in versions before 4.3.3 in src/decoderallocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server...

Devolutions Server 授权问题漏洞

Devolutions Server is an application from Devolutions Canada. It provides a full-featured shared account and password management solution. An authorization issue vulnerability exists in Devolutions Server versions prior to 2020.3 that stems from an authentication outage for Windows domain users. ...

CVE-2021-23988

Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 87...

Input validation

There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The greatest impact of this flaw is to system availability...