Code injection

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs...

CVE-2021-37864 Users can view the contents of an archived channel when access is explicitly denied by the system admin

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs...

CVE-2021-37864 Users can view the contents of an archived channel when access is explicitly denied by the system admin

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs...

PT-2022-10681 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 6.1 and earlier Description: The issue arises from insufficient permission validation when viewing archived channels. This allows authenticated users to bypass system administrator restrictions and view the contents of...

Rocket.Chat: getRoomRoles Method leaks Channel Owner

Summary Lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients. Description Lack of ACL checks in the getRoomRoles Meteor method allow unauthorized clients to query channel members with special roles: javascript Meteor.methods...

Kalkitech Sync Products 加密问题漏洞

Kalkitech Sync Products is a range of substation gateways from Kalkitech India. Kalkitech Sync Products suffers from an encryption issue vulnerability that stems from the use of an insecure communication channel by the management tools Easyconnect and SYNC devices, which can be exploited by an...

GSD-2021-1002684 xen/blkfront: harden blkfront against event channel storms

xen/blkfront: harden blkfront against event channel storms This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.168 by commit...

CVE-2021-30990

creationtimestamp| type| source ---|---|--- 2021-12-16 06:45:25+00:00| published-proof-of-concept| https://t.me/BlueRedTeam/1486 2021-12-16 12:39:02+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/4985...

DEBIAN-CVE-2021-43518

Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow. A map parser does not validate mChannels value coming from a map file, leading to a buffer overflow. A malicious server may offer a specially crafted map that will overwrite client's stack causing denial of service or code...

UBUNTU-CVE-2021-43518

Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow. A map parser does not validate mChannels value coming from a map file, leading to a buffer overflow. A malicious server may offer a specially crafted map that will overwrite client's stack causing denial of service or code...

14 New XS-Leaks (Cross-Site Leaks) Attacks Affect All Modern Web Browsers

Researchers have discovered 14 new types of cross-site data leakage attacks against a number of modern web browsers, including Tor Browser, Mozilla Firefox, Google Chrome, Microsoft Edge, Apple Safari, and Opera, among others. Collectively known as "XS-Leaks," the browser bugs enable a malicious...

Auerswald COMpact 8.0B Backdoors

Advisory: Auerswald COMpact Multiple Backdoors RedTeam Pentesting discovered several backdoors in the firmware for the Auerswald COMpact 5500R PBX. These backdoors allow attackers who are able to access the web-based management application full administrative access to the device. Details =======...

Crypto Hackers Using Babadeda Crypter to Make Their Malware Undetectable

A new malware campaign has been discovered targeting cryptocurrency, non-fungible token NFT, and DeFi aficionados through Discord channels to deploy a crypter named "Babadeda" that's capable of bypassing antivirus solutions and stage a variety of attacks. "This malware installer has been used in ...

Rocket.Chat: getUserMentionsByChannel leaks messages with mention from private channel

Summary The getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room. Description When calling the getUserMentionsByChannel method, the server does not check the users access to the given room...

CVE-2021-1940

creationtimestamp| type| source ---|---|--- 2021-11-23 11:50:05+00:00| published-proof-of-concept| https://t.me/BlueRedTeam/1209 2022-05-08 19:29:38+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/4817 2026-09-01 17:00:34+00:00| seen| https://t.me/cissp/4879 2026-09-02...

Information disclosure

Information disclosure through timing and power side-channels during mod exponentiation for RSA-CRT in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice &...

CVE-2021-1924

CVE-2021-1924 is an information-disclosure vulnerability arising from timing and power-side channels during RSA-CRT mod exponentiation in Qualcomm/Snapdragon closed-source components (notably in Snapdragon Auto/Compute/Connectivity families). The issue is described across multiple sources, includ...

Update Custom Virtual Channels on Citrix Workspace app for Mac

macOS expects a unique UUID for every plug-in it loads in the latest build toolchain. Objective As an end-user, you can load Custom Virtual Channel VC SDK successfully after upgrading to Citrix Workspace app Mac 2110 or later. Background In Citrix Workspace app for Mac 2110, the developer build...

November 9, 2021 Servicing Stack Update (KB5007349)

None None...

Qualcomm 多款组件加密问题漏洞

Qualcomm MDM9206 and others are products of Qualcomm Incorporated.MDM9206 is a central processing unit CPU.MDM9607 is a central processing unit CPU.MDM9640 is a central processing unit CPU.MDM9650 is a central processing unit CPU.MSM8996AU is a central processing unit CPU.QCA6574AU is a central...