Kentico SQL Injection Vulnerability (CNVD-2021-22156)

Kentico is an all-in-one ASP.NET CMS that fully integrates Web content management, e-commerce, online marketing and intranet into one platform. A SQL injection vulnerability exists in the Blog module in Kentico 5.5 R2 build 5.5.3996. The vulnerability can be exploited by an attacker via the tagna...

EFB Tampering 1. Introduction and Class Differences

TL;DR Electronic flight bags EFBs are devices that flight crews use to help with flight management tasks Different airlines use different devices e.g. iPads, netbooks, custom devices Some are carried on by flight crew, others are built-in to the cockpit Some important functions are carried out by...

PT-2021-11751

Name of the Vulnerable Software and Affected Versions: Courier Management System version 1.0 Description: A SQL injection issue was found, which can be exploited through the ref no parameter in a POST request to the "admin class.php" endpoint. This allows for potential unauthorized access and...

Vulnerabilities fixed in Cisco NX-OS

Vulnerabilities have been fixed in NX-OS. The vulnerabilities allow a malicious person to perform attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Denial-of-Service DoS. Manipulation of data Cisco categorizes these vulnerabilities according to the CVSSv3...

Vulnerabilities fixed in the Ubuntu kernel

Vulnerabilities have been fixed in the Ubuntu kernel. The vulnerabilities allow a malicious person to carry out attacks execute attacks that lead to the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution User rights...

Vulnerabilities fixed in Red Hat OpenShift Container Platform

Red Hat has fixed multiple vulnerabilities in OpenShift Container Platform. The vulnerabilities are in the applications Jenkins and Ant, and allow an unauthenticated remote malicious person to remote may be able to launch attacks that result in the following categories of damage: Cross-Site...

Vulnerabilities fixed in NetApp Active IQ

NetApp has fixed several vulnerabilities in Active IQ. The vulnerabilities allow an unauthenticated remote malicious person to remote may be able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Access to sensitive data NetApp has...

PT-2021-17877

Name of the Vulnerable Software and Affected Versions: Acrobat Reader DC versions 2020.013.20074 and earlier Acrobat Reader DC versions 2020.001.30018 and earlier Acrobat Reader DC versions 2017.011.30188 and earlier Description: A missing support for integrity check issue allows an unauthenticat...

Oracle MySQL Server 5.6 <= 5.6.10 Security Update (cpuapr2013) - Windows

Oracle MySQL Server is prone to multiple unspecified vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fake Forcepoint Chrome Extension Hacks Windows Users

Cybercriminals have been using a novel approach to exfiltrate data that involves directly injecting malicious Google Chrome extensions onto victims’ Windows machines via the abuse of Google’s cloud synching function. The goal of the recently-identified campaign is to manipulate data in internal w...

OESA-2021-1008 freerdp security update

FreeRDP is a client implementation of the Remote Desktop Protocol RDP that follows Microsoft's open specifications. This package provides the client applications xfreerdp and wlfreerdp.\r\n\r\n Security Fixes:\r\n\r\n libfreerdp/core/update.c in FreeRDP versions 1.1 through 2.0.0-rc4 has an...

Large number of vulnerabilities fixed in Xerox FreeFlow Print Server

Xerox has fixed a large number of vulnerabilities in Xerox FreeFlow Print Server. The vulnerabilities are in the following underlying components: Microsoft Windows 7 Java 8 Firefox Misuse of the vulnerabilities allow unauthenticated remote malicious actors to launch attacks that can result in the...

Shopping Cart Component Oracle iStore Unauthorized Access

The vulnerability of the Shopping Cart component in the Oracle iStore system, which is used for creating, managing, and personalizing e-commerce stores, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...

MySQL Server DoS

The vulnerability of the MySQL Server component relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker to cause service interruptions using the MySQL network protocol...

Dialog Box Component Unauthorized Access

The vulnerability of the Dialog Box component in application maintenance, repair, and major equipment overhauls related to Oracle Complex Maintenance, Repair, and Overhaul lies in deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

Vulnerabilities fixed in the Debian kernel

Vulnerabilities have been fixed in Debian's kernel. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Access to system data Increased user privileges Debian has released...

PT-2021-10601

Name of the Vulnerable Software and Affected Versions: koa2-blog version 1.0.0 Description: The issue allows remote attackers to inject malicious SQL statements via the name parameter to the signin page. This can be exploited by injecting a malicious SQL statement, potentially leading to...

CVE-2021-1998

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

MySQL Server DoS

The vulnerability of the MySQL Server component relates to deficiencies in access control. Exploiting this vulnerability can allow an attacker to cause a service failure using the MySQL protocol...

PT-2021-11907

Name of the Vulnerable Software and Affected Versions: BDTASK Multi-Store Inventory Management System version 1.0 Description: The issue allows a local admin to inject arbitrary code via the Customer Name Field. This enables the execution of malicious scripts, potentially leading to unauthorized...