Remote Code Execution (RCE)

xstream is vulnerable to remote code execution. An attacker may exploit the vulnerability by injection code via the input stream...

PT-2021-18973 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.6.1 Description: The issue involves multiple out-of-bounds write problems that have been resolved through enhanced bounds checking. A malicious application could potentially execute arbitrary code with kernel...

PT-2021-18998 · Apple · Tvos +4

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.1 watchOS versions prior to 8.3 iOS versions prior to 15.2 iPadOS versions prior to 15.2 tvOS versions prior to 15.2 Description: A race condition was addressed with improved state handling. This issue allows a...

Command Injection

sssd is vulnerable to command injection. The vulnerability exists due to the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands...

Denial Of Service (DoS)

binutils is vulnerable to denial of service. An out of bounds flaw in the objdump utility allows an attacker to exploit the vulnerability by passing a large section to avrelf32loadrecordsfromsection which will result in a crash or in some cases memory corruption...

PT-2021-4731 · Adobe +4 · Xmp Toolkit Sdk +4

Name of the Vulnerable Software and Affected Versions: XMP Toolkit SDK versions 2020.1 and earlier Description: The issue is related to a buffer overflow in dynamic memory, potentially allowing an attacker to access protected information or cause a denial of service. Exploitation requires user...

Smart Email Alerts <= 1.0.10 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the apikey in the /views/settings.php file which allows attackers to inject arbitrary web scripts...

Denial Of Service (DoS)

libspf2:edge is vulnerable to denial of service. Processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages...

OS Command Injection

topthink/think is vulnerable OS command injection. An attacker is able to inject malicious PHP code via /library/think/App.php...

SQL Injection in extension "Newsletter" (newsletter)

It has been discovered that the extension is susceptible to SQL Injection when processing bounced emails...

Improper Restriction of XML External Entity Reference

The package glances are vulnerable to XML External Entity XXE Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks...

Open Redirection

url-parse is vulnerable to open redirection. Lack of URL validation allows an attacker to redirect a user to a malicious website...

PT-2021-5512 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue is related to incorrect code generation management in the Hyper-V hardware virtualization system of Windows operating systems. It allows a remote attacker to execute...

Arbitrary File Read

phantomjs is vulnerable to arbitrary file read. An attacker is able to read arbitrary system files via an XMLHttpRequest with a file:// URI...

PT-2021-10273 · Halo · Halo

Name of the Vulnerable Software and Affected Versions: Halo version 0.4.3 Description: A File Deletion issue exists via the delBackup function. Recommendations: For Halo version 0.4.3, consider restricting access to the delBackup function as a temporary workaround until a patch is available...

PT-2021-20814 · Fidelis · Fidelis Network/Deception

Name of the Vulnerable Software and Affected Versions: Fidelis Network and Deception versions prior to 9.3.3 Description: The issue concerns user credentials being stored in a recoverable format within the system. If an attacker gains access to the CommandPost, they could decode and use these...

PT-2021-5840

Name of the Vulnerable Software and Affected Versions vsftpd affected versions not specified Sendmail affected versions not specified Nginx affected versions not specified Description The issue is related to an application layer protocol content confusion attack, exploiting TLS servers implementi...

Denial Of Service (DoS)

Info-ZIP is vulnerable to Denial Of Service DoS. It is possible due to a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12...

Denial Of Service (DoS)

Mutt is vulnerable to denial of service. An out-of-bounds read in imap/util.c where an IMAP sequence set ends with a comma could result in disclosure of confidential information or an application crash...

Cotonti Siena 0.9.19 Cross Site Scripting

Exploit Title: Cotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site Scripting Date: 2021-15-06 Exploit Author: Fatih İLGİN Vendor Homepage: cotonti.com Vulnerable Software: https://www.cotonti.com/download/siena0919 Affected Version: 0.9.19 Tested on: Windows 10 Vulnerable Parameter Type: POST...