GSD-2021-1001176 bus: mhi: core: Validate channel ID when processing command completions

bus: mhi: core: Validate channel ID when processing command completions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.13.6 by commit...

UVI-2021-1001160 bpf, sockmap: Fix potential memory leak on unlikely error case

bpf, sockmap: Fix potential memory leak on unlikely error case This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.13.6 by commit...

UVI-2021-1001156 igb: Fix use-after-free error during reset

igb: Fix use-after-free error during reset This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.13.6 by commit...

GSD-2021-1001154 bpf: Track subprog poke descriptors correctly and fix use-after-free

bpf: Track subprog poke descriptors correctly and fix use-after-free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.13.5 by commit...

UVI-2021-1001150 cifs: prevent NULL deref in cifs_compose_mount_options()

cifs: prevent NULL deref in cifscomposemountoptions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.13.5 by commit...

CVE-2021-34632

creationtimestamp| type| source ---|---|--- 2021-08-03 00:27:54+00:00| seen| https://t.me/cibsecurity/26709...

CVE-2021-37216

creationtimestamp| type| source ---|---|--- 2021-08-02 16:27:25+00:00| seen| https://t.me/cibsecurity/26674 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-37216.yaml...

RUSTSEC-2021-0093 Data race in crossbeam-deque

In the affected version of this crate, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this stil...

IntelliChoice eFORCE Software Suite 2.5.9 - Username Enumeration

Exploit Title: IntelliChoice eFORCE Software Suite 2.5.9 - Username Enumeration Date: 03.05.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.eforcesoftware.com IntelliChoice eFORCE Software Suite v2.5.9 Username Enumeration Vendor: IntelliChoice, Inc. Product web page:...

You’ve Found a Vulnerability! Now What? A Guide to Responsible Disclosure.

Information security researchers make a valuable contribution to our online security by finding vulnerabilities and facilitating getting them fixed. Wordfence has been finding and disclosing vulnerabilities in WordPress core, WordPress plugins, and WordPress themes since 2011. Our research has...

IntelliChoice eFORCE Software Suite v2.5.9 Username Enumeration

Summary IntelliChoice is a United States software company that was founded in 2003, and offers a software title called eFORCE Software Suite. eFORCE Software Suite is law enforcement software, and includes features such as case management, court management, crime scene management, criminal...

CVE-2021-35030

A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting XSS attack via a crafted LLDP packet...

Zyxel GS1900-8 跨站脚本漏洞

The Zyxel GS1900-8 is an intelligent managed switch with gigabit speeds and basic management features from Taiwan, China-based Hopkins Zyxel that brings greater flexibility and connectivity to users' business networks. A cross-site scripting vulnerability exists in the Zyxel GS1900-8 firmware,...

CVE-2021-37468

NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files...

KevinLAB BEMS 1.0 - Undocumented Backdoor Account

Exploit Title: KevinLAB BEMS 1.0 - Undocumented Backdoor Account Date: 05.07.2021 Exploit Author: LiquidWorm Vendor Homepage: http://www.kevinlab.com Vendor: KevinLAB Inc. Product web page: http://www.kevinlab.com Affected version: 4ST L-BEMS 1.0.0 Building Energy Management System Summary:...

A New Security Paradigm: External Attack Surface Management

Ran Nahmias, Co-founder and CBO, Cyberpion In the past, a web application or online service could be taken at face value by your customers and employees. It was created, developed, and secured by your organization, and every element of the IT infrastructure that supported that service was under...

CVE-2021-34429

creationtimestamp| type| source ---|---|--- 2021-07-15 20:26:58+00:00| seen| https://t.me/cibsecurity/26189 2021-11-03 09:15:34+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/796 2021-11-12 18:09:42+00:00| seen|...

CVE-2021-0292

An Uncontrolled Resource Consumption vulnerability in the ARP daemon arpd and Network Discovery Protocol ndp process of Juniper Networks Junos OS Evolved allows a malicious attacker on the local network to consume memory resources, ultimately resulting in a Denial of Service DoS condition...

CVE-2021-0277

An Out-of-bounds Read vulnerability in the processing of specially crafted LLDP frames by the Layer 2 Control Protocol Daemon l2cpd of Juniper Networks Junos OS and Junos OS Evolved may allow an attacker to cause a Denial of Service DoS, or may lead to remote code execution RCE. Continued receipt...

Design/Logic Flaw

An Uncontrolled Resource Consumption vulnerability in the ARP daemon arpd and Network Discovery Protocol ndp process of Juniper Networks Junos OS Evolved allows a malicious attacker on the local network to consume memory resources, ultimately resulting in a Denial of Service DoS condition...