CVE-2021-32790

Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors already having admin access, or API keys to the WooCommerce site can exploit vulnerable...

PT-2021-5391 · Foxit · Foxit Phantompdf +1

Name of the Vulnerable Software and Affected Versions: Foxit PhantomPDF and Foxit Reader affected versions not specified Description: The issue is related to an out-of-bounds read in the handling of Annotation objects, which can result from the lack of proper validation of user-supplied data. Thi...

Forma Learning Management System SQL注入漏洞

Forma Learning Management System LMS is a Learning Management System LMS. A security vulnerability exists in Learning Management System v 1.0, which can be exploited by remote attackers to execute arbitrary SQL statements via the id parameter and obtain sensitive database information...

UBUNTU-CVE-2021-35942

The wordexp function in the GNU C Library aka glibc through 2.33 may crash or read arbitrary memory in parseparam in posix/wordexp.c when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but...

OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host (Networking, 8258432)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows...

CVE-2021-35521

A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP packets...

CVE-2021-22522

Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier versions. The vulnerability could allow disclosure of confidential data...

CVE-2021-22522

Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier versions. The vulnerability could allow disclosure of confidential data...

CVE-2021-35521

A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP packets...

IDEMIA Morpho Wave Compact缓冲区错误漏洞

IDEMIA Morpho Wave Compact is an industrial control device from idemia. Contactless fingerprint scanner. A security vulnerability exists in IDEMIA Morpho Wave Compact and VisionPass devices prior to version 2.6.2, which originates from a buffer overflow in the Thrift command handler in the device...

PT-2021-3706 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue is related to a lack of protection for sensitive data in Microsoft Edge, which could allow a remote attacker to disclose protected information using a...

The vulnerability of the exif_data_save_data_entry function in the library for grammatical analysis of EXIF files in libexif, related to reading beyond the permissible buffer limits, allows a perpetrator to access confidential information or cause service failures.

The vulnerability of the exifdatasavedataentry function in the EXIF-file grammar analysis library libexif is related to reading data beyond the permissible buffer limits. Exploiting this vulnerability could allow an attacker to access confidential information or cause service failures...

CVE-2021-2400

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware component: E-Business Suite - XDO. Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

CVE-2021-1098

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager vGPU plugin, where it doesn't release some resources during driver unload requests from guests. This flaw allows a malicious guest to perform operations by reusing those resources, which may lead to information disclosure,...

CVE-2021-1098

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager vGPU plugin, where it doesn't release some resources during driver unload requests from guests. This flaw allows a malicious guest to perform operations by reusing those resources, which may lead to information disclosure,...

UBUNTU-CVE-2021-1094

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape where an out of bounds array access may lead to denial of service or information disclosure...

PT-2021-6691 · Nvidia +2 · Nvidia Gpu Display Driver +2

Name of the Vulnerable Software and Affected Versions: NVIDIA GPU Display Driver for Windows and Linux affected versions not specified Description: The issue is related to an out of bounds array access in the kernel mode layer handler for DxgkDdiEscape, which may lead to denial of service or...

The vulnerability of Google Chrome’s V8 engine, related to the execution of operations beyond the buffer in memory, allows attackers to access confidential information or cause service failures.

The vulnerability of Google Chrome’s V8 engine is related to insufficient input validation. Exploiting this vulnerability can allow an attacker to access confidential information or cause service failures...

The vulnerability in the FliDecode.c function from the Pillow image processing library involves reading data beyond the allowed buffer limits. This allows an attacker to access confidential information or cause service failures.

The vulnerability in the function from the libImaging/FliDecode.c library, which is used for working with images in Pillow, involves reading data beyond the acceptable buffer limits. Exploiting this vulnerability could allow an attacker to access confidential information or cause service failures...

CVE-2021-20595

Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers G-50A Ver.3.35 and prior, GB-50A Ver.3.35 and prior, GB-24A Ver.9.11 and prior, AG-150A-A Ver.3.20 and prior, AG-150A-J Ver.3.20 and prior, GB-50ADA-A Ver.3.2...