CVE-2021-28421

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21417. Reason: This candidate is a duplicate of CVE-2021-21417. Notes: All CVE users should reference CVE-2021-21417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...

UBUNTU-CVE-2021-28421

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21417. Reason: This candidate is a duplicate of CVE-2021-21417. Notes: All CVE users should reference CVE-2021-21417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

CVE-2021-28421

FluidSynth contains a use-after-free in sfloader/fluid_sffile.c triggered while parsing SoundFont 2 files. This can allow remote code execution or denial of service if a specially crafted SoundFont is loaded. Remediation per connected sources includes upgrading to patched releases (e.g., FluidSyn...

CVE-2021-21640

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names...

OESA-2021-1117 tomcat security update

The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open developmen...

function buyBond charges msg.sender twice

Email address [email protected] Handle paulius.eth Eth address 0x523B5b2Cc58A818667C22c862930B141f85d49DD Vulnerability details function buyBond transfers amount from msg.sender twice: Fundfund.depositFormsg.sender, issuer, amount; ... collectTokenissuer, msg.sender, amount; Impact This makes th...

Jenkins security vulnerabilities

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

View name validation bypass

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name. When a form to create a view is submitted, the name is included twice in the submission. One instance is validated, but the other instance is used to create the value. This...

Amazon Linux AMI : tomcat8 (ALAS-2021-1491)

The version of tomcat8 installed on the remote host is prior to 8.5.63-1.87. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1491 advisory. A deserialization flaw was discovered in Apache Tomcat's use of a FileStore. Under specific circumstances, an attacker...

Uploading Enterprise App (Private App) to Google Play Store via Cloud Endpoint Management Fails - Error "Upload a new APK file with a different package name"

Uploading an APK file to Managed Google Play Store as instructed in Citrix Documentationyou receive the following error message: "Upload a new APK file with a different package name "...

OPENSUSE-SU-2021:0423-1 Security update for postgresql12

This update for postgresql12 fixes the following issues: Upgrade to version 12.6: - Reindexing might be needed after applying this update. - CVE-2021-3393, bsc1182040: Fix information leakage in constraint-violation error messages. This update was imported from the SUSE:SLE-15-SP1:Update update...

rConfig 3.9.6 Local File Inclusion

Exploit Title: rConfig 3.9.6 - 'path' Local File Inclusion Authenticated Date: 2021-03-12 Exploit Author: 5a65726f Vendor Homepage: https://www.rconfig.com Software Link: https://www.rconfig.com/downloads/rconfig-3.9.6.zip Version: rConfig v3.9.6 Install scripts :...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-35782. Reason: This candidate is a reservation duplicate of CVE-2020-35782. Notes: All CVE users should reference CVE-2020-35782 instead of this candidate. All references and descriptions in this candidate have been removed t...

CVE-2020-35232

This CVE-2020-35232 entry is rejected/not used and does not represent an active vulnerability entry.

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-35801. Reason: This candidate is a reservation duplicate of CVE-2020-35801. Notes: All CVE users should reference CVE-2020-35801 instead of this candidate. All references and descriptions in this candidate have been removed t...

EulerOS Virtualization 3.0.2.6 : perl (EulerOS-SA-2021-1446)

According to the version of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment...

UBUNTU-CVE-2019-18351

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-18790. Reason: This candidate is a duplicate of CVE-2019-18790. Notes: All CVE users should reference CVE-2019-18790 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

CVE-2021-0448

Unknown description...

CVE-2021-25122: Exposure of Sensitive Information to an Unauthorized Actor

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's...

CVE-2020-8297

Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference IDOR vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user...