CVE-2021-43820

The CVE-2021-43820 entries describe a permissions-check bypass in Seafile: the in-memory sync token cache does not verify library association in the request URL, allowing a token to access data from any known library if the attacker discovers a library ID. Affected product: Seafile (Seaf-server t...

Seafile 安全漏洞

Seafile is an open source enterprise cloud disk from Haven Hootsuite Network Technologies. The product features Markdown WYSIWYG editing, Wiki, file labeling, and more. Seafile has a security vulnerability that stems from the use of synchronization tokens in the Seafile file synchronization...

@sobotics/caching (=1.1.1) potentially affected by CVE-2015-9545 via xdlocalstorage (=2.0.5)

xdlocalstorage NPM version =2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on xdlocalstorage and may be impacted: - @sobotics/caching =1.1.1 Source cves: CVE-2015-9545 Source advisory: OSV:GHSA-76QM-4F93-FG6F...

@sobotics/caching (=1.1.1) potentially affected by CVE-2020-11611 via xdlocalstorage (=2.0.5)

xdlocalstorage NPM version =2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on xdlocalstorage and may be impacted: - @sobotics/caching =1.1.1 Source cves: CVE-2020-11611 Source advisory: OSV:GHSA-C6C4-JMQX-3R33...

@sobotics/caching (=1.1.1) potentially affected by CVE-2015-9544 via xdlocalstorage (=2.0.5)

xdlocalstorage NPM version =2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on xdlocalstorage and may be impacted: - @sobotics/caching =1.1.1 Source cves: CVE-2015-9544 Source advisory: OSV:GHSA-VRC7-6G8W-JH56...

CVE-2021-43800 Asset directory traversal with some storage modules on Windows

Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special...

[SECURITY] Fedora 34 Update: vdr-scraper2vdr-1.0.11-14.20190128gitd9f6cb4.fc34.1

Scraper2vdr acts as client and provides scraped metadata for tvshows and movies from epgd to other plugins via its service interface. The plugin cares about caching the images locally and also cleans up the images if not longer needed. epgd itself uses the thetvdb.com API for collecting series...

Fedora: Security Advisory for vdr-scraper2vdr (FEDORA-2021-b58af96f33)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

RESTEasy: Caching routes in RootNode may result in DoS

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service...

mediawiki -- multiple vulnerabilities

Mediawiki reports: T292763. CVE-2021-44854 REST API incorrectly publicly caches autocomplete search results from private wikis. T271037, CVE-2021-44856 Title blocked in AbuseFilter can be created via Special:ChangeContentModel. T297322, CVE-2021-44857 Unauthorized users can use action=mcrundo to...

RESTEasy: Caching routes in RootNode may result in DoS

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service...

Open-xchange OX App Suite Information Disclosure Vulnerability (CNVD-2021-90765)

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company that allows users to more intuitively manage email, tasks, files, etc. An information disclosure vulnerability exists in Open-xchange OX App Suite. An information disclosure...

Oracle Linux 8 : glibc (ELSA-2021-9560)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9560 advisory. - CVE-2021-33574: Deep copy pthread attribute in mqnotify 1966472 - CVE-2021-35942: wordexp: handle overflow in positional parameter number 1979127 -...

CVE-2021-38378

OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name...

CVE-2021-38378

OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name...

CVE-2021-38378

OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name...

Information disclosure

OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name...

CVE-2021-41271

Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could cause a loss of confidentiality for some content. This issue is patched in the latest stable, beta and tests-passed...

Fedora: Security Advisory for bind-dyndb-ldap (FEDORA-2021-39b33260b8)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Siemens Mendix Information Disclosure Vulnerability

A security vulnerability exists in Siemens Mendix, a low-code application development platform from Siemens, Germany. The vulnerability stems from the fact that applications built with the affected version of Mendix Studio Pro do not prevent the caching of file documents when opening or downloadi...