CVE-2021-41339

Microsoft DWM Core Library Elevation of Privilege Vulnerability...

CVE-2021-41346

Console Window Host Security Feature Bypass Vulnerability...

Security feature bypass

Console Window Host Security Feature Bypass Vulnerability...

CVE-2021-41346 Console Window Host Security Feature Bypass Vulnerability

...

CVE-2021-41346

CVE-2021-41346 refers to a security feature bypass vulnerability in the Windows Console Window Host. Exploitation is local (AV:L, UI:N, integrity/confidentiality/availability impact: partial), effectively bypassing security controls and potentially enabling privilege escalation or data exposure a...

CVE-2021-41346 Console Window Host Security Feature Bypass Vulnerability

...

Mozilla: Validation message could have been overlaid on another origin

Through use of reportValidity and window.open, a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerability affects Firefox 93, Thunderbird 91.2, and Firefox ESR 91.2...

Console Window Host Security Feature Bypass Vulnerability

...

Microsoft Windows 安全特征问题特征问题漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security feature issue vulnerability exists in Microsoft Console Window Host. The following products and editions are affected:Windows 10 Version 21H1 for x64-based...

PT-2021-4685 · Microsoft · Console Window Host +1

Name of the Vulnerable Software and Affected Versions: Console Window Host affected versions not specified Description: The issue is related to errors in security settings of the Console Window Host component in Microsoft Windows operating systems. This allows an attacker to bypass security...

Mozilla: Validation message could have been overlaid on another origin

Through use of reportValidity and window.open, a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerability affects Firefox 93, Thunderbird 91.2, and Firefox ESR 91.2...

CVE-2021-0595

In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

CVE-2020-28119

Cross site scripting vulnerability in 53KF 2.0.0.2 that allows for arbitrary code to be executed via crafted HTML statement inserted into chat window...

CVE-2020-28119

Cross site scripting vulnerability in 53KF 2.0.0.2 that allows for arbitrary code to be executed via crafted HTML statement inserted into chat window...

Cross site scripting

Cross site scripting vulnerability in 53KF 2.0.0.2 that allows for arbitrary code to be executed via crafted HTML statement inserted into chat window...

CVE-2020-28119

Cross site scripting vulnerability in 53KF 2.0.0.2 that allows for arbitrary code to be executed via crafted HTML statement inserted into chat window...

53Kf 跨站脚本漏洞

Zhejiang Express Service 53Kf is an online customer service system from the Chinese company Zhejiang Express Service. A cross-site scripting vulnerability exists in 53KF, which is caused by the product's chat window not validating user input. The vulnerability can be exploited to cause client-sid...

EulerOS 2.0 SP9 : libgcrypt (EulerOS-SA-2021-2556)

According to the versions of the libgcrypt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attac...

EulerOS 2.0 SP8 : libgcrypt (EulerOS-SA-2021-2469)

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel atta...

Siemens SINEMA Server

1. EXECUTIVE SUMMARY CVSS v3 4.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SINEMA Server Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain encoded...