Apple tvOS 缓冲区错误漏洞

Apple tvOS is a set of smart TV operating systems from the U.S. company Apple. A buffer error vulnerability exists in multiple Apple products, which could allow an attacker to cause arbitrary code execution via maliciously crafted web content. The vulnerability is fixed in the following products...

PT-2021-18969 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.8.1 iOS versions prior to 15.0.1 iPadOS versions prior to 14.8.1 iPadOS versions prior to 15.0.1 Description: A Lock Screen issue was addressed with improved state management, which may have allowed a user to view...

PT-2021-22565 · Gnome +2 · Gnome Libgda +2

Name of the Vulnerable Software and Affected Versions: GNOME libgda versions prior to 6.0.1 Description: The issue is related to the failure to enable TLS certificate verification on the SoupSessionSync objects created in gda-web-provider.c, making users susceptible to network man-in-the-middle...

CVE-2021-32999

Improper handling of exceptional conditions in SuiteLink server while processing command 0x01...

GPAC 输入验证错误漏洞

GPAC Project on Advanced Content is an open source cross-platform library that implements the MPEG-4 system standard and provides tools for media playback, vector graphics, and 3D rendering.The MPEG-4 decoding feature of GPAC Project on Advanced Content library 1.0.1 suffers from an integer...

CVE-2021-22674

The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and directories on the WebAccess/SCADA WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1...

CVE-2021-34633

The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the /youtube-feeder.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.1...

CVE-2021-34632

The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the locconfig function found in the /seo-backlinks.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.1...

CVE-2021-35029

An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected devi...

UBUNTU-CVE-2021-32565

Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1...

CVE-2021-32954

Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbitrary files on the file system...

Advantech WebAccess/SCADA 输入验证错误漏洞

Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. An open redirection vulnerability exist...

CVE-2021-23024

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

AppCMS Arbitrary File Deletion Vulnerability (CNVD-2021-40850)

AppCMS is a content management system CMS for mobile application downloads. A security vulnerability exists in AppCMS version 2.0.101, which can be exploited by an attacker to delete arbitrary files on the site...

CVE-2021-32015

In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-volatile memory. NOTE: Upgrading to firmware version 7.4.0.1 will mitigate against the vulnerability, but version 7.4.0.1 is not TCG or Comm...

css-what 安全漏洞

css-what is a CSS selector parser. A security vulnerability exists in css-what versions prior to 5.0.1, which stems from the fact that the css-what package does not ensure that property parsing has linear time complexity with respect to input size. No details of the vulnerability are available at...

CVE-2021-20725

Reflected cross-site scripting vulnerability in the admin page of Calendar01 free edition ver1.0.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors...

SUSE-SU-2021:1637-1 Security update for python-httplib2

This update for python-httplib2 contains the following fixes: Security fixes included in this update: - CVE-2021-21240: Fixed a regular expression denial of service via malicious header bsc1182053. - CVE-2020-11078: Fixed an issue where an attacker could change request headers and body bsc1171998...

Siemens Mendix 安全漏洞

Siemens Mendix is a low-code application development platform from Siemens. The platform provides application development, testing, deployment, and iteration. A security vulnerability exists in Siemens Mendix. The vulnerability stems from the system's use of XML file upload table mappings that...

CVE-2021-27437

The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation on the WISE-PaaS/RMM versions prior to...