PT-2021-21204 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 Description: The issue concerns an arbitrary file deletion vulnerability that can be exploited using the Windows feature of NTFS called Symbolic links...

Rucky 加密问题漏洞

Rucky is an Android application that performs the Usb Hid attack Rubber Duck in multiple ways. Rucky is vulnerable to an encryption issue that stems from the use of weak encryption algorithms RSA/ECB/PKCS1Padding. The issue will be patched in v2.3 for releases and after 426 for nightly releases. ...

Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition

Description CSRF allows enable/disable bots CSRF allows flush chatbox Proof of Concept After logging in to unit3d.site, Access this link: https://unit3d.site/dashboard/chat/bots/2/disable, https://unit3d.site/dashboard/chat/bots/2/enable See that the chat bot is disabled/enabled correspondingly...

PT-2021-23316 · D Link · D-Link Dcs-932L +1

Name of the Vulnerable Software and Affected Versions: D-Link DCS-5000L version 1.05 and older D-Link DCS-932L version 2.17 and older Description: An Elevated Privileges issue exists due to the use of digest-authentication for the devices command interface, potentially allowing malicious users on...

Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition

Description Attacker is able to disable the form Proof of Concept When you logged in open this POC.html in a browser. You can put the website into maintenance mode. history.pushState'', '', '/' document.forms0.submit; Impact This vulnerability is capable of disabling the website...

PT-2021-10901 · Unknown · Leo Editor

Name of the Vulnerable Software and Affected Versions: Leo Editor version 6.2.1 Description: The issue is related to a regular expression denial of service ReDoS vulnerability in the component plugins/importers/dart.py. This vulnerability was discovered in the Leo Editor. Recommendations: For Leo...

PT-2021-4147

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions prior to the fixed version Description The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit...

curl security update

7.61.1-18.el84.1 - fix bad connection reuse due to flawed path name checks CVE-2021-22924 - disable metalink support to fix the following vulnerabilities CVE-2021-22923 - metalink download sends credentials CVE-2021-22922 - wrong content via metalink not discarded...

PYSEC-2021-321

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger thi...

UBUNTU-CVE-2021-39213

GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API bypass with custom header injection. This issue is fixed in version 9.5.6. One may disable API Rest as a workaround...

UBUNTU-CVE-2021-39210

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie when a user uses the "remember me" feature is accessible by scripts. A malicious plugin that could steal this cookie would be able to use it to autologin. This issue ...

CVE-2021-3752

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to...

PT-2021-23021

Name of the Vulnerable Software and Affected Versions TinyFileManager versions up to and including 2.4.6 Description A Stored XSS issue exists in TinyFileManager when the server is given a file that contains HTML and javascript in its name. A malicious user can upload a file with a malicious...

PT-2021-22465 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.1 through 9.5.6 Description: GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API bypass with custom header injection. Thi...

PT-2021-23019

Name of the Vulnerable Software and Affected Versions TinyFileManager versions up to and including 2.4.6 Description A Path Traversal issue exists that allows attackers to upload a file with the fullpath parameter containing path traversal strings ../ and .. to escape the server's intended workin...

PT-2021-22463 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.6 Description: The issue affects the autologin cookie used when the "remember me" feature is enabled, making it accessible to scripts. A malicious plugin could exploit this to steal the cookie and use it for...

CVE-2021-32724

check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the...

Nextcloud Information Disclosure Vulnerability (CNVD-2021-70109)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An information disclosure vulnerability exists in Nextcloud Richdocuments, which stems from the fact that there is no rate limitation on Richdocuments OCS...

CVE-2021-32802

Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several...

CVE-2021-37629

Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended that the Nextcloud Richdocuments app is...