8588 matches found
CVE-2021-30256
Possible stack overflow due to improper validation of camera name length before copying the name in VR Service in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT...
Oracle Critical Patch Update Advisory - October 2021
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third-party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches add...
Security Bulletin: A vulnerabbility exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager CVE-2021-2388, CVE-2021-2369, CVE-2021-2432, CVE-2021-2341.
Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v3.9, v4.1 and v4.2 which was disclosed in the Oracle July 2021 Critical Patch Update. Vulnerability Details Refer to the security bulletins listed in the...
Wallarm starts to highlight CVE to address OWASP Top-10 A6 Vulnerable and Outdated Components
Attacks against known vulnerabilities are one of the most common security risks. Have you seen an updated OWASP Top-10? A risk that used to be A09 Using Components with Known Vulnerabilities is now titled A06:2021-Vulnerable and Outdated Components. This category moved up to 06 from 9 in 2017. We...
Adobe Acrobat Reader 路径遍历漏洞
Adobe Acrobat Reader is the United States of America Audobee Adobe, a PDF viewer. A path traversal vulnerability exists in Adobe Acrobat Reader, which stems from a configuration or other error in the operation of the product. An unauthorized attacker could exploit the vulnerability to obtain...
mysql: Server: Components Services unspecified vulnerability (CPU Jan 2021)
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are 8.0.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...
SAP BusinessObjects Business Intelligence Platform和SAP BusinessObjects Business Intelligence Platform 代码问题漏洞
SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly and...
Microsoft Windows Print Spooler Components 信息泄露漏洞
Microsoft Windows Print Spooler Components is a printing backend handler component from Microsoft Corporation USA. An information disclosure vulnerability exists in Microsoft Windows Print Spooler Components. The following products and versions are affected: Windows 10 Version 20H2 for ARM64-base...
Security Bulletin: IBM App Connect Enterprise Certified Container Designers may be vulnerable to arbitrary code execution via CVE-2021-3757
Summary IBM App Connect Enterprise Certified Container may be vulnerable to arbitrary code execution via CVE-2021-3757. This only affects App Connect Designers Vulnerability Details CVEID: CVE-2021-3757 DESCRIPTION: Node.js immer module could allow a remote attacker to execute arbitrary code on t...
Security Bulletin: IBM App Connect Enterprise Certified Container could disclose sensitive information to a local user when it is configured to use an IBM Cloud API key to connect to cloud-based connectors (CVE-2021-29906)
Summary IBM App Connect Enterprise may include the hash of an IBM Cloud API key that is used by an Integration Server in the Pod definition of that Integration Server. This is only present if the Integration Server is configured to communicate with the cloud-based connectors in a cloud instance o...
CVE-2021-38398
The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker with physical access to the affected device could exploit these vulnerabilities...
Pixel Update Bulletin—October 2021Stay organized with collectionsSave and categorize content based on your preferences.
The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2021-10-05 or later address all issues in this bulletin and all issues in the October 2021 Android...
CVE-2021-38398
The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker with physical access to the affected device could exploit these vulnerabilities...
Security Bulletin: IBM Disconnected Log Collector is vulnerable to using components with known vulnerabilities (CVE-2016-3506, CVE-2020-13692)
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2016-3506 DESCRIPTION: An unspecified vulnerability in multiple Oracle products could allow an unauthenticated attacker to take...
The 2021 OWASP Top 10 Have Evolved: Here's What You Should Know
Late last week, the Open Web Application Security Project OWASP released its top 10 list of critical web application security risks. The last OWASP Top 10 came out in 2017, and in the intervening 4 years, we've seen a fundamental shift in application security that includes greater emphasis on...
New Tomiris Backdoor Found Linked to Hackers Behind SolarWinds Cyberattack
Cybersecurity researchers on Wednesday disclosed a previously undocumented backdoor likely designed and developed by the Nobelium advanced persistent threat APT behind last year's SolarWinds supply chain attack, joining the threat actor's ever-expanding arsenal of hacking tools...
Confluent Ansible 安全漏洞
Confluent Ansible is a product from the US-based Confluent, Inc. It provides an easy way to deploy, manage and configure Confluent Platform services. A security vulnerability exists in Confluent Ansible cp-ansible versions 5.5.0, 5.5.1, 5.5.2, and 6.0.0, in which its auxiliary components are...
DongTai - An Interactive Application Security testing(IAST) Product That Supports The Detection Of OWASP WEB TOP 10 Vulnerabilities, Multi-Request Related Vulnerabilities (Including Logic Vulnerabilities, Unauthorized Access Vulnerabilities, Etc.), Third-Party Component Vulnerabilities, Etc.
中文版本Chinese version About DongTai IAST DongTai IAST is an open-source passive interactive security testing IAST product. It uses dynamic hooks and taint tracking algorithms to achieve universalvulnerability detection and multiples request associated withvulnerability detection including but not...
YzmCMS Cross-site Request Forgery Vulnerability (CNVD-2021-90912)
YzmCMS is a lightweight open source content management system based on PHP Mysql architecture developed solely by Yuan Zhimeng. A cross-site request forgery vulnerability exists in /controller/pay.class.php in YzmCMS version 5.5. An attacker can use this vulnerability to access sensitive componen...
