File uploading vulnerability in the smart water information management platform

Huatech Digital Technology Co., Ltd. formerly Shanda Luneng Information Technology Co., Ltd. was jointly invested and established by Shandong University and Luneng Group in December 2000, which is now subordinate to Shandong Province State-owned Assets Supervision and Administration Commission...

Weak Password Vulnerability in H3C Switch S5120-28P-HPWR-SI Management Platform

Xinhua San Technologies Co., Ltd. has a full range of overall digital infrastructure capabilities in computing, storage, networking, 5G, security, etc., and provides one-stop digital solutions including cloud computing, big data, artificial intelligence, industrial internet, information security,...

WordPress Easy Digital Downloads plugin <= 2.10.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by WPScan team in WordPress Easy Digital Downloads plugin versions = 2.10.2. Solution Update the WordPress Easy Digital Downloads plugin to the latest available version at least 2.10.3...

XSS Vulnerability in Digital Campus Integrated Management System of Anhui Kexun Education Equipment Co.

Anhui Kexun Education Equipment Co., Ltd. is a professional information technology integrated service provider specializing in computer software research and development, sales and service. XSS vulnerability exists in the Digital Campus Digital Campus Integrated Management System of Anhui Kexun...

Easy Digital Downloads < 2.10.3 - Unauthorised Stripe Disconnect via CSRF

The plugin did not property check for CSRF when disconnecting Stripe, allowing attackers to make logged in users with the manageoptions capability disconnect the Stripe gateway via a CSRF attack. PoC https://example.com/wp-admin/admin-post.php?page=edd-settings&edds-stripe-disconnect;=1...

Adobe Digital Editions <= 4.5.11.187245 Privilege Escalation (macOS) (APSB21-26)

Adobe Digital Editions version 4.5.11.187245 and earlier is affected by a privilege escalation vulnerability during installation. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary file system write in the context of the current user. Exploitation of this issue...

CVE-2021-21100

Adobe Digital Editions version 4.5.11.187245 and earlier is affected by a Privilege Escalation vulnerability during installation. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary file system write in the context of the current user. Exploitation of this issue...

CVE-2021-21100

Adobe Digital Editions version 4.5.11.187245 and earlier is affected by a Privilege Escalation vulnerability during installation. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary file system write in the context of the current user. Exploitation of this issue...

Privilege escalation

Adobe Digital Editions version 4.5.11.187245 and earlier is affected by a Privilege Escalation vulnerability during installation. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary file system write in the context of the current user. Exploitation of this issue...

CVE-2021-21100

Adobe Digital Editions 4.5.11.187245 and earlier are affected by a Privilege Escalation vulnerability during installation that allows arbitrary file system writes in the context of the current user. Exploitation requires user interaction (victim must open a malicious file). The issue is tracked a...

CVE-2021-21100 Adobe Digital Editions Arbitrary file system write vulnerability

Adobe Digital Editions version 4.5.11.187245 and earlier is affected by a Privilege Escalation vulnerability during installation. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary file system write in the context of the current user. Exploitation of this issue...

CVE-2021-21100 Adobe Digital Editions Arbitrary file system write vulnerability

Adobe Digital Editions version 4.5.11.187245 and earlier is affected by a Privilege Escalation vulnerability during installation. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary file system write in the context of the current user. Exploitation of this issue...

CVE-2021-21100: Creation of Temporary File in Directory with Insecure Permissions

Adobe Digital Editions version 4.5.11.187245 and earlier is affected by a Privilege Escalation vulnerability during installation. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary file system write in the context of the current user. Exploitation of this issue...

Adobe Digital Editions Arbitrary File System Write Vulnerability (APSB21-26) - Mac OS X

Adobe Digital Edition is prone to arbitrary file system write vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

nettle: Out of bounds memory access in signature verification

A flaw was found in Nettle, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an...

GO-2021-0056

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...

GO-2020-0050 XML digital signature validation bypass in github.com/russellhaering/goxmldsig

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...

GO-2020-0046 Panic due to malformed XML digital signature in github.com/russellhaering/goxmldsig

Due to a nil pointer dereference, a malformed XML Digital Signature can cause a panic during validation. If user supplied signatures are being validated, this may be used as a denial of service vector...

GO-2020-0047 Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...

GO-2021-0060 Authentication bypass in github.com/russellhaering/gosaml2

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...