PT-2021-7178

Name of the Vulnerable Software and Affected Versions Oracle FLEXCUBE Universal Banking versions 12.3 through 12.4 Oracle FLEXCUBE Universal Banking versions 14.0 through 14.4 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE...

PT-2021-6702

Name of the Vulnerable Software and Affected Versions GDAL versions 2.4.2 through 3.0.4 Description The issue is related to a stack-based buffer overflow in the netCDF component of the GDAL library, which can be exploited to gain access to confidential data, compromise data integrity, and cause a...

Advisory ROSA-SA-2021-1828

Software: emacs 24.3 OS: Cobalt 7.9 CVE-ID: CVE-2014-3421 CVE-Crit: CRITICAL CVE-DESC: lisp / gnus / gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files using a symbolic link attack on the temporary file /tmp/gnus.face.ppm. CVE-STATUS: default CVE-REV: defaul...

in getgrav/grav

✍️ Description A cookie with an overly broad path can be accessed through other applications on the same domain. 🕵️‍♂️ Proof of Concept Application deployed at http://real.example.com/grav and the application sets a session ID cookie with path "/" when users log in to the forum. then below code is...

PT-2021-6720

Name of the Vulnerable Software and Affected Versions libavif versions 0.8.0 through 0.8.1 Description The issue is related to an out-of-bounds write in the avifDecoderDataFillImageGrid function of the libavif library, which is used for encoding and decoding .avif files. This can allow a remote...

Auto-merging Person Records Compromised

Impact New user registrations are able to access anyone's account by only knowing their basic profile information name, birthday, gender, etc. This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages such as giving and events. Patches We have...

GHSA-R578-PJ6F-R4FF Auto-merging Person Records Compromised

Impact New user registrations are able to access anyone's account by only knowing their basic profile information name, birthday, gender, etc. This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages such as giving and events. Patches We have...

OpenEMR 5.0.0 - Remote Code Execution (Authenticated) Exploit

Exploit Title: OpenEMR 5.0.0 - Remote Code Execution Authenticated Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://www.open-emr.org/ Software Link: https://sourceforge.net/projects/openemr/files/OpenEMR%20Current/5.0.0/openemr-5.0.0.zip/download Version: 5.0.0 Tested on: Windows 10...

Cyberattack Forces Meat Producer to Shut Down Operations in U.S., Australia

The world’s largest meat distributor shut down some operations in both the United States and Australia over the Memorial Day weekend after a cyberattack on its IT systems that could have a significant effect on the food supply chain if not resolved quickly. Attackers targeted several servers...

PT-2021-7311

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 89 Description The issue is related to the lack of proper validation of incoming requests, which could allow a remote attacker to access and compromise confidential data. Additionally, there's a concern with how Firef...

Bose Admits Ransomware Hit: Employee Data Accessed

High-end audio-tech specialist Bose has disclosed a ransomware attack, which it said rippled “across Bose’s environment” and resulted in the possible exfiltration of employee data. The incident began on March 7, according to a disclosure letter sent to the Attorney General’s Office in New...

CVE-2021-27562

In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Valu...

PT-2021-6482

Name of the Vulnerable Software and Affected Versions GPAC versions 1.0.1 Description The issue is related to the co64 decoder functionality in the GPAC multimedia platform, specifically in the MPEG-4 decoding. It involves incorrect checking of the result of an arithmetic operation, which can lea...

PT-2021-4067

Name of the Vulnerable Software and Affected Versions Redis affected versions not specified Description The issue is related to a buffer overflow in memory within the Redis database management system. It can be exploited by a remote attacker to access confidential data, compromise data integrity,...

Update mechanism Passwordstate compromised

Click Studios, the manufacturer of Passwordstate, has announced announced that its automatic update mechanism has been abused to offer malicious files for download. If you meet these criteria: - you are currently using version 9.1 build 9117, - Passwordstate applies updates automatically, - and t...

CVE-2021-2307

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Packaging. Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to...

CVE-2021-2316

Vulnerability in the Oracle HRMS France product of Oracle E-Business Suite component: French HR. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS France. Successful attack...

CVE-2021-2284

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

CVE-2021-2286

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

CVE-2021-2266

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...