Exclusive: SonicWall Hacked Using 0-Day Bugs In Its Own VPN Product

SonicWall, a popular internet security provider of firewall and VPN products, on late Friday disclosed that it fell victim to a coordinated attack on its internal systems. The San Jose-based company said the attacks leveraged zero-day vulnerabilities in SonicWall secure remote access products suc...

PT-2021-13844 · Privoxy +3 · Privoxy +3

Name of the Vulnerable Software and Affected Versions: Privoxy versions prior to 3.0.29 Description: A flaw was found that could result in a crash if accept-intercepted-requests was enabled. This occurs when Privoxy fails to get the request destination from the Host header and a memory allocation...

EulerOS 2.0 SP3 : freerdp (EulerOS-SA-2021-1066)

According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in updatereadbitmapdata that allows client memory to be read to an imag...

PT-2021-2723 · Microsoft · Office +4

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Microsoft Office affected versions not specified Microsoft Office Web Apps Server affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Microsoft Offi...

PT-2021-11668 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server and Data Center versions prior to 7.2.0 Description: The issue allows remote attackers to impact the application's availability via a Denial of Service DoS vulnerability in the avatar upload feature. Recommendation...

PT-2021-3597 · Selinux +6 · Selinux +6

Name of the Vulnerable Software and Affected Versions: SELinux version 3.2 Description: The issue is related to a use-after-free error in the cil verify classperms function of the SELinux access control system. This error can be exploited to cause a denial of service. The cil verify classperms...

PT-2021-14791 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle version 3.10 Description: A command execution vulnerability exists in the default legacy spellchecker plugin. This issue can be exploited through a specially crafted series of HTTP requests, leading to command execution. An attacker mu...

PT-2021-14354 · Onedev · Onedev

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3 Description: The issue is related to a pre-auth server side template injection via Bean validation message tampering in OneDev, an all-in-one devops platform. This was fixed in version 4.0.3 by disabling...

PT-2021-3554 · Unknown +5 · Imagemagick +5

Name of the Vulnerable Software and Affected Versions: ImageMagick versions 6.9.11-57 through 7.0.10-57 Description: The issue is related to a divide-by-zero flaw in the gem.c file of ImageMagick, which can be exploited by submitting a crafted file to trigger undefined behavior. This flaw poses a...

DEBIAN-CVE-2021-21261

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the flatpak-portal service that can allow sandboxed applications to execute arbitrary code on the host system a sandbox escape. This sandbox-escape bug is present in versio...

PT-2021-10922 · Unknown · Thinkadmin

Name of the Vulnerable Software and Affected Versions: ThinkAdmin versions 4.x through 6.x Description: An insecure unserialize vulnerability was discovered in ThinkAdmin, which may lead to arbitrary remote code execution. The issue is located in files such as "app/admin/controller/api/Update.php...

PT-2021-7595 · Unknown +1 · Cgal Libcgal +1

Name of the Vulnerable Software and Affected Versions: CGAL libcgal version 5.1.1 Description: Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code...

PT-2021-7617 · Unknown +1 · Cgal Libcgal +1

Name of the Vulnerable Software and Affected Versions: CGAL libcgal version 5.1.1 Description: The issue is related to multiple code execution vulnerabilities in the Nef polygon-parsing functionality. A specially crafted malformed file can lead to an out-of-bounds read and type confusion,...

PT-2021-7590 · Unknown +1 · Cgal Libcgal +1

Name of the Vulnerable Software and Affected Versions: CGAL libcgal version 5.1.1 Description: The issue is related to multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal. A specially crafted malformed file can lead to an out-of-bounds read and type...

PT-2021-7597 · Unknown +1 · Cgal Libcgal +1

Name of the Vulnerable Software and Affected Versions: CGAL libcgal version 5.1.1 Description: The issue is related to multiple code execution vulnerabilities in the Nef polygon-parsing functionality. A specially crafted malformed file can lead to an out-of-bounds read and type confusion,...

CVE-2020-24003

Microsoft Skype through 8.59.0.77 on macOS has the disable-library-validation entitlement, which allows a local process with the user's privileges to obtain unprompted microphone and camera access by loading a crafted library and thereby inheriting Skype Client's microphone and camera access...

CVE-2020-24003

Microsoft Skype through 8.59.0.77 on macOS has the disable-library-validation entitlement, which allows a local process with the user's privileges to obtain unprompted microphone and camera access by loading a crafted library and thereby inheriting Skype Client's microphone and camera access...

CVE-2020-17509

ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected...

Design/Logic Flaw

ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected...

CVE-2020-17509

ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected...