CVE-2021-35477

A flaw in the Linux kernel allows a privileged BPF program to obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel in the eBPF subsystem Mitigation The default Red Hat Enterprise Linux kernel setting prevents unprivileged users from being able to use eBPF vi...

PT-2021-13891 · Mongodb · Mongodb Rust Driver

Name of the Vulnerable Software and Affected Versions: MongoDB Rust Driver versions 1.0.0 through 1.2.1 MongoDB Rust Driver version 2.0.0-alpha MongoDB Rust Driver version 2.0.0-alpha1 Description: The issue affects the MongoDB Rust Driver, where specific versions can include credentials used by...

PT-2021-7768 · 3S Smart Software Solutions · Codesys Development System

Name of the Vulnerable Software and Affected Versions: CODESYS Development System versions 3.5.16 through 3.5.17 Description: A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality. This vulnerability can be triggered by a specially...

Panasonic Sanyo CCTV Network Camera 2.03-0x - Cross-Site Request Forgery (Change Password)

Exploit Title: Panasonic Sanyo CCTV Network Camera 2.03-0x - 'Disable Authentication / Change Password' CSRF Date: 13.07.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.panasonic.com !-- Panasonic Sanyo CCTV Network Camera 2.03-0x CSRF Disable Authentication / Change Password Vendor:...

Cross-Site Request Forgery (CSRF) in devcode-it/openstamanager

✍️ Description Attacker able to disable any Personal Data module if users visit attacker site. 🕵️‍♂️ Proof of Concept 1.Open the PoC.html In Firefox or safari. 2.now you can check that Personal data module with id value equal to 1 have been disabled. // PoC.html history.pushState'', '', '/'...

Panasonic Sanyo CCTV Network Camera 2.03-0x Cross Site Request Forgery

!-- Panasonic Sanyo CCTV Network Camera 2.03-0x CSRF Disable Authentication / Change Password Vendor: Panasonic Corporation | SANYO Electric Co., Ltd. Product web page: https://www.panasonic.com https://www.sanyo-av.com https://panasonic.net/sanyo/cs/index.html Affected version: Model: VCC-HD5600...

PT-2021-5821 · Node.Js +7 · Node.Js +7

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to 12.22.4 Node.js versions prior to 14.17.4 Node.js versions prior to 16.6.0 Description: The issue is related to a use after free attack in Node.js, where an attacker might exploit memory corruption to change process...

Panasonic Sanyo CCTV Network Camera 2.03-0x Cross Site Request Forgery Vulnerability

Panasonic Sanyo CCTV Network Camera version 2.03-0x allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. These actions can be exploited to perform authentication detriment and account password change with administrative privilege...

PT-2021-21856 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.147 Description: The issue allows Stored XSS when viewing galaxy cluster relationships. This occurs in the app/View/Elements/GalaxyClusters/view relation tree.ctp file. Recommendations: For MISP version 2.4.147, consider...

PT-2021-5452 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Foxit PhantomPDF affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where...

PT-2021-14805 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit Software’s PDF Reader version 10.1.4.37651 Description: A use-after-free issue exists in the JavaScript engine of Foxit Software’s PDF Reader. This can be triggered by a specially crafted PDF document, leading to the reuse of previously...

PT-2021-14823 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit Software’s PDF Reader version 11.0.0.49893 Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader. A specially crafted PDF document can trigger the reuse of previously freed memory,...

PT-2021-6760 · Otrs Ag · Otrs +1

Name of the Vulnerable Software and Affected Versions: OTRS AG OTRS Community Edition versions 6.0.1 and later OTRS AG OTRS versions 7.0.27 and prior OTRS AG OTRS versions 8.0.14 and prior Description: The issue is related to the disclosure of information in the OTRS ticket system. It allows a...

PT-2021-7728 · Hdf5 +3 · Hdf5 +3

Name of the Vulnerable Software and Affected Versions: HDF5 versions 1.12.0 through 1.13.0 Description: The issue is related to a buffer overflow in the h5tools str sprint function, located in /hdf5/tools/lib/h5tools str.c, which can cause a denial of service. This can be exploited by a remote...

PT-2021-6726

Name of the Vulnerable Software and Affected Versions lwIP version git head Description A buffer overflow vulnerability in the icmp6 send response with addrs and netif function allows attackers to access sensitive information via a crafted ICMPv6 packet. The issue is related to the copying of a...

PT-2021-6778 · Curl +7 · Curl +7

Name of the Vulnerable Software and Affected Versions: curl versions prior to 7.77.0 Description: The issue is related to insufficient protection of registration data, allowing a remote attacker to access confidential data. When curl is instructed to get content using the metalink feature and a...

kernel security and bug fix update

4.18.0-305.10.24.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

CVE-2021-32774

DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CSRF attacks so requests to generate or delete dumps could be forged. The vulnerability was patched in commit...

Cross site request forgery (csrf)

DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CSRF attacks so requests to generate or delete dumps could be forged. The vulnerability was patched in commit...

PT-2021-11763 · Unknown · Phpgurukul Employee Record Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Employee Record Management System version 1.1 Description: The issue allows remote attackers to execute arbitrary SQL commands and bypass authentication. This is a SQL injection vulnerability. Recommendations: For PHPGurukul Employ...