CVE-2021-31350

An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit JET API on Juniper Networks Junos OS and Junos OS Evolved, allows a network-based, low-privileged authenticated attacker to perform operations as root, leading to complete compromise of the...

CVE-2021-38476

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of a username. This may allow an attacker to enumerate different user accounts...

MGASA-2021-0462 Updated opendmarc packages fix security vulnerability

OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field CVE-2019-20790. OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication...

CVE-2021-41120

CVE-2021-41120 affects the Sylius PayPal plugin. In affected versions, the payment-page URL used after checkout was predictable due to an autoincremented payment id in the path (/pay-with-paypal/{id}). The credit card form prefilled the cardholder name with the customer’s first and last name and ...

多款Qualcomm产品授权问题漏洞

Qualcomm SDX55 and others are products of Qualcomm Incorporated Qualcomm.SDX55 is a modem.IPQ6018 is a central processing unit CPU product.QCA6390 is a central processing unit CPU product. Multiple Qualcomm Products WLAN An authorization issue vulnerability exists in that the vulnerability stems...

OTRS 授权问题漏洞

A security vulnerability exists in OTRS, a German OTRS application, a service management software, due to a problem in the development and implementation of the lost password feature. A malicious attacker could exploit this vulnerability to be able to perform a valid user login via the "lost...

Huawei HarmonyOS 授权问题漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. A security vulnerability exists in Huawei HarmonyOS, which stems from a component of the product that does not effectively authenticate users. An attacker could...

CVE-2021-30908

An authentication issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1, macOS Big Sur 11.6.1. A local attacker may be able to view the previous logged-in user’s desktop from the fast user switching screen...

Apple macOS Big Sur 后置链接漏洞

Apple macOS Big Sur is a mobile application app from Apple USA. A security vulnerability exists in various Apple products that originates from an authentication issue in the handling of symbolic links. The application can be exploited to access restricted files. The issue is fixed in Catalina, iO...

CVE-2021-31337

The CVE-2021-31337 issue concerns the Telnet service of the SIMATIC HMI Comfort Panels component. The Telnet service does not require authentication, potentially allowing a remote attacker to gain access if the service is enabled. Affected products/versions include SINAMICS SL150 (all versions), ...

Rockstar Games: Social Club Account Takeover Via RGL And Steam/Epic Linked Account

In this report, the researcher discovered and demonstrated a method to hijack access to a Social Club account via a previously-linked Epic Games or Steam account. To perform the attack, the attacker first needed access to a Steam or Epic Games account with entitlement to a game with Social Club...

Design/Logic Flaw

A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exploit this...

Critical RCE Vulnerability Found in VMware vCenter Server — Patch Now!

VMware has rolled out patches to address a critical security vulnerability in vCenter Server that could be leveraged by an adversary to execute arbitrary code on the server. Tracked as CVE-2021-21985 CVSS score 9.8, the issue stems from a lack of input validation in the Virtual SAN vSAN Health...

Apple macOS 信息泄露漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. An information disclosure vulnerability exists in macOS, which stems from an authentication issue in the CoreFoundation component. The following products and versions are affected: macOS: 11.0 20A2411, 11.0.1...

CVE-2021-26074

Broken Authentication in Atlassian Connect Spring Boot ACSB from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a...

CVE-2021-26074

CVE-2021-26074 affects Atlassian Connect Spring Boot (ACSB) versions 1.1.0 through 2.1.2 (before 2.1.3). The root cause is that ACSB erroneously accepts context JWTs on lifecycle endpoints (e.g., installation) where only server-to-server JWTs should be accepted, enabling an attacker to send authe...

UBUNTU-CVE-2021-29943

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts...

CVE-2020-29633

An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. An attacker in a privileged...

CVE-2020-29633

An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. An attacker in a privileged...

Design/Logic Flaw

An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model...