CVE-2021-38376

OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call...

Session fixation

OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call...

Security update for hylafax+ (moderate)

openSUSE Security Update: Security update for hylafax+ Announcement ID: openSUSE-SU-2021:1494-1 Rating: moderate References: 1191571 Affected Products: openSUSE Backports SLE-15-SP3 An update that contains security fixes can now be installed. Description: hylafax+ was updated to version 7.0.4:...

Ivanti Avalanche 命令注入漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. Ivanti Avalanche suffers from a command injection vulnerability that stems from not properly validating a...

Ivanti Avalanche MapShare Service Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the mapShare method. The...

Ivanti Avalanche PrinterDeviceServer Service Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the runAgentRestarter metho...

CVE-2020-12962

Escape call interface in the AMD Graphics Driver for Windows may cause privilege escalation...

Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the currentmonthdivider parameter of its meclistloadmore AJAX call available to both unauthenticated and authenticated users before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue PoC...

AMD Graphics Driver 安全漏洞

AMD Graphics Driver is an integrated graphics driver from AMD. A security vulnerability exists in AMD Graphics Driver, which is caused due to an issue with the Escape call interface for privilege restrictions in the Windows AMD Graphics Driver, and can be exploited by an attacker to cause an...

BasePool.swap() Is Callable By Anyone

Handle leastwood Vulnerability details Impact The BasePool.swap function differs from its implementation in BasePoolV2.swap in which it lacks an onlyRouter modifier. This ensures that users cannot call this function directly as VaderRouter.swap performs some necessary input validation which can b...

Anyone Can Arbitrarily Call FSDVesting.updateVestedTokens()

Handle leastwood Vulnerability details Impact The updateVestedTokens function is intended to be called by the FSD.sol contract when updating a user's vested token amount. A check is performed to ensure that user == beneficiary, however, as user is a user controlled argument, it is possible to spo...

RHEL 8 : kernel-rt (RHSA-2021:4140)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4140 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

CentOS 8 : kernel (CESA-2021:4356)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4356 advisory. - kernel: Intel graphics card information leak. CVE-2019-14615 - kernel: out-of-bounds reads in pinctrl subsystem. CVE-2020-0427 - kernel: Improper inp...

RHEL 8 : grafana (RHSA-2021:4226)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4226 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. The following packages have be...

CVE-2020-23890

A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service DoS via a crafted JPG file. Related to Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at JPGCodec+0x753648...

Critical Citrix DDoS Bug Shuts Down Network, Cloud App Access

A critical security bug in the Citrix Application Delivery Controller ADC and Citrix Gateway could allow cyberattackers to crash entire corporate networks without needing to authenticate. The two affected Citrix products formerly the NetScaler ADC and Gateway are used for application-aware traffi...

CVE-2021-32022

A low privileged delete vulnerability using CEF RPC server of BlackBerry Protect for Windows versions versions 1574 and earlier could allow an attacker to potentially execute code in the context of a BlackBerry Cylance service that has admin rights on the system and gaining the ability to delete...

Microsoft Teams calls do not connect with older versions of Citrix Workspace app for Chrome OS

Users who meet all 3 below conditions use versions of the Citrix Workspace app for Chrome OS 2110 and older update to Chrome OS Version 96 and above, AND have enabled Microsoft Teams optimization will see screen sharing/joining meetings/calls not connecting from Microsoft Teams within virtual...

grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call

A flaw was found in Grafana. The snapshot feature allows unauthenticated remote attackers to trigger a denial of service DoS via a remote API call if anonymous access is enabled. The highest threat from this vulnerability is to system availability...

kernel: heap overflow in __cgroup_bpf_run_filter_getsockopt()

A flaw buffer overflow in the Linux kernel BPF subsystem was found in the way user running BPF script calling getsockopt. A local user could use this flaw to crash the system or possibly escalate their privileges on the system...