CVE-2021-30531

Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page...

SUSE-SU-2021:1856-1 Security update for slurm_18_08

This update for slurm1808 fixes the following issues: - CVE-2021-31215: remote code execution as SlurmUser because of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling bsc1186024...

Security update for mpv (important)

openSUSE Security Update: Security update for mpv Announcement ID: openSUSE-SU-2021:0798-1 Rating: important References: 1186230 Cross-References: CVE-2021-30145 CVSS scores: CVE-2021-30145 NVD : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 An...

Zephyr Out-of-Bounds Read Vulnerability

Zephyr is a small real-time operating system for connected, resource-constrained embedded devices. A security vulnerability exists in Zephyr versions = 1.14.2 and = 2.3.0. An attacker could exploit this vulnerability to achieve remote code execution...

CVE-2021-29659

ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could...

PT-2021-3670 · Xstream +5 · Xstream +5

Name of the Vulnerable Software and Affected Versions: XStream versions prior to 1.4.17 Description: A vulnerability in XStream may allow a remote attacker with sufficient rights to execute commands of the host by manipulating the processed input stream. The issue is related to shortcomings in th...

CVE-2021-28799 Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 Hybrid Backup Sync. If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to...

PT-2021-18642 · Merit Lilin Ent.Co. +1 · P2/Z2/P3/Z3 Ip Camera Firmware +38

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The sensitive information of a webcam device is not properly protected, allowing remote attackers to grant administrator credentials without authentication and further control the...

PT-2021-4979

Name of the Vulnerable Software and Affected Versions GitLab versions 11.9 through 13.10.2 GitLab CE/EE versions prior to 14.0 Description The issue is related to insufficient input validation in GitLab when parsing image files, allowing remote command execution. This has been exploited in...

CVE-2021-21204

chromium is vulnerable to remote code execution. The vulnerability exists due to a use-after-free error within the Blink component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2021-39257)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a denial of service vulnerability, which can be exploited by remote attackers to cause the browser to crash...

MariaDB 10.4.0 < 10.4.18

The version of MariaDB installed on the remote host is prior to 10.4.18. It is, therefore, affected by a vulnerability as referenced in the 10.4.18 advisory. - A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before...

CVE-2021-31152

Multilaser Router AC1200 V02.03.01.45pt contains a cross-site request forgery CSRF vulnerability. An attacker can enable remote access, change passwords, and perform other actions through misconfigured requests, entries, and headers...

CVE-2021-21180

Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-21176

Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2021-21174

Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

ytnef double release vulnerability

ytnef is a program that collaborates with procmail to decode TNEF streams. A double release vulnerability exists in the TNEFSubjectHandler function in lib/ytnef.c in ytnef 1.9.3. A remote attacker can exploit this vulnerability via specially crafted files to cause a denial of service and possibly...

CVE-2021-26855 Microsoft Exchange Server Remote Code Execution Vulnerability

...

D-Link DNS-320 Command Injection Vulnerability

The D-Link DNS-320 is a NAS Network Attached Storage device from D-Link Taiwan, China. The D-Link DNS-320 FW v2.06B01 Revision suffers from a command injection vulnerability that stems from the effects of command injection in the mgr.cgi component, which could lead to remote arbitrary code...

CMSUno 1.6.2 - 'lang' Remote Code Execution (Authenticated)

Exploit Title: CMSUno 1.6.2 - 'lang/user' Remote Code Execution Authenticated Google Dorks: inurl:uno/central.php inurl:uno/config.php inurl:uno.php intitle:"CMSUno - Login" Exploit Author: noraj Alexandre ZANNI for SEC-IT https://secit.fr https://www.exploit-db.com/?author=10066 Vendor Homepage:...