PT-2021-2881

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite component: Shopping Cart versions 12.1.1 through 12.1.3 Oracle E-Business Suite component: Shopping Cart versions 12.2.3 through 12.2.10 Description The issue is related to inadequate access control in the Shopping Cart...

PT-2021-4541

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 90.0.4430.212 Description The issue is related to a use after free in the Notifications component of Google Chrome, which can be exploited by a remote attacker using a specially crafted HTML page. This could...

PT-2021-4580

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 90.0.4430.212 Description The issue is related to a use after free in the Tab Strip component of Google Chrome, which could allow a remote attacker to access confidential data, compromise its integrity, and caus...

PT-2021-4538

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 91.0.4472.77 Description The issue is related to a use after free vulnerability in the Bookmarks component of Google Chrome. This could allow a remote attacker to access confidential data, compromise its...

PT-2021-5831

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 90.0.4430.212 Description The issue is related to a use after free condition in the Payments component of Google Chrome, which can be exploited by an attacker to access sensitive information, compromise data...

Hewlett Packard Enterprise Network Orchestrator uaf-token SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Hewlett Packard Enterprise Network Orchestrator. Authentication is not required to exploit this vulnerability. The specific flaw exists within the connections resource. A crafted uaf-token...

CVE-2020-24791

FUEL CMS 1.4.8 allows SQL injection via the 'fuelreplaceid' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

Sql injection

FUEL CMS 1.4.8 allows SQL injection via the 'fuelreplaceid' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

EulerOS Virtualization 2.9.1 : cryptsetup (EulerOS-SA-2021-1594)

According to the version of the cryptsetup package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is...

QIWI: Remote Code Execution on contactws.contact-sys.com via SQL injection in TAktifBankObject.GetOrder in parameter DOC_ID

Summary The API interface on https://contactws.contact-sys.com:3456/ accepts a body to interact with the server's AppServ object. Because of insufficient input validation, an attacker can abuse the DOCID parameter on the TAktifBankObject operation GetOrder to inject arbitrary SQL statements into...

Yandex Employee Caught Selling Access to Users' Email Inboxes

Russian Dutch-domiciled search engine, ride-hailing and email service provider Yandex on Friday disclosed a data breach that compromised 4,887 email accounts of its users. The company blamed the incident on an unnamed employee who had been providing unauthorized access to the users' mailboxes for...

PT-2021-3613

Name of the Vulnerable Software and Affected Versions GNU Screen versions through 4.8.0 Description The issue is related to incorrect handling of UTF-8 character sequences in the encoding.c component of GNU Screen. This can be exploited by a remote attacker to gain access to confidential data,...

WestRock Ransomware Attack Hinders Packaging Production

WestRock – the second-largest packaging company in the U.S. – continues to restore its systems, two weeks after it discovered it was the victim of a ransomware attack. WestRock, which has more than 320 manufacturing facilities globally, creates packaging supplies for a bevy of high-profile client...

Industrial Gear at Risk from Fuji Code-Execution Bugs

Industrial control software ICS from Fuji Electric is vulnerable to several high-severity arbitrary code-execution security bugs, according to a federal warning. Authorities are warning the flaws could allow physical attacks on factory and critical-infrastructure equipment. Fuji Electric’s Tellus...

CVE-2020-6779

CVE-2020-6779 affects Bosch FSM-2500 and FSM-5000 servers (up to v5.2). The root cause is hard-coded credentials in the database, enabling an unauthenticated remote attacker to log in with admin privileges. Impact stated: complete compromise of confidentiality and integrity of stored data and hig...

CVE-2021-2128

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2021-2102

Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle Supply Chain component: Dialog Box. Supported versions that are affected are 11.5.10, 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2021-2104

Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle Supply Chain component: Dialog Box. Supported versions that are affected are 11.5.10, 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2021-2093

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite component: CRM User Management Framework. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2021-2090

Vulnerability in the Oracle Email Center product of Oracle E-Business Suite component: Message Display. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Ema...