CVE-2020-12061

An issue was discovered in Nitrokey FIDO U2F firmware through 1.1. Communication between the microcontroller and the secure element transmits credentials in plain. This allows an adversary to eavesdrop the communication and derive the secrets stored in the microcontroller. As a result, the attack...

Nitrokey FIDO U2F security vulnerability

Nitrokey FIDO2 is an open source security key that supports FIDO2 and U2F standards for strong two-factor authentication and passwordless login. A security vulnerability exists in Nitrokey FIDO U2F firmware version 1.1 and prior versions, which stems from the fact that communications between the...

PT-2021-9436 · Nitrokey · Nitrokey Fido U2F

Name of the Vulnerable Software and Affected Versions: Nitrokey FIDO U2F firmware versions through 1.1 Description: An issue in the communication between the microcontroller and the secure element allows an adversary to eavesdrop and derive secrets stored in the microcontroller, enabling arbitrar...

jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...

CVE-2021-3423

CVE-2021-3423 describes an uncontrolled search path element issue in the OpenSSL usage within Bitdefender GravityZone Business Security that enables local privilege escalation by loading a third-party DLL. Affected versions are GravityZone Business Security prior to 6.6.23.329. The root cause is ...

PT-2021-20406

Name of the Vulnerable Software and Affected Versions: Bitdefender GravityZone Business Security versions prior to 6.6.23.329 Description: The issue is related to an Uncontrolled Search Path Element vulnerability in the openssl component used in Bitdefender GravityZone Business Security. This...

Bitdefender GravityZone Business Security code-related vulnerabilities

Bitdefender GravityZone Business is an application from the American company Bitdefender. A scanning software. A code issue vulnerability exists in Bitdefender GravityZone Business Security prior to version 6.6.23.329, which stems from an uncontrolled search path element vulnerability in the...

CVE-2020-24755: Uncontrolled Search Path Element

In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory. This allows the impersonation and modification of the library to execute code on the system. This was tested in Windows 7 x64/Windows 10 x64...

CVE-2021-29558

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in tf.rawops.SparseSplit. This is because the...

PT-2021-18268 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4 Description: A malicious user could trigger a division by 0 in the Conv3D implementation. The implementatio...

UBUNTU-CVE-2020-25713

A malformed input file can lead to a segfault due to an out of bounds array access in raptorxmlwriterstartelementcommon...

CVE-2021-25694: Uncontrolled Search Path Element

Teradici PCoIP Graphics Agent for Windows prior to 21.03 does not validate NVENC.dll. An attacker could replace the .dll and redirect pixels elsewhere...

Aurelia framework cross-site scripting vulnerabilities

Aurelia framework is a front-end JavaScript framework for building browser, mobile, and desktop applications. Aurelia framework has a cross-site scripting vulnerability. A remote attacker can conduct XSS attacks via JavaScript code in the properties of various other elements...

YzmCMS Cross-Site Scripting Vulnerability (CNVD-2021-39769)

Yzmcms is an open source CMS Content Management System. A cross-site scripting vulnerability exists in YzmCMS version 5.6. The vulnerability stems from the program using UEditor 1.4.3.3, so the vulnerability can be exploited through the SRC attribute of the IFRAME element in...

GHSA-Q26W-WJJ2-22VV Cross-site scripting in Joplin

Joplin allows XSS via a LINK element in a note...

Cross-site Scripting in quill

A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. No patch exists and no further releases are planned. This CVE is disputed. Researchers have claimed that...

GHSA-4943-9VGG-GR5R Cross-site Scripting in quill

A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. No patch exists and no further releases are planned. This CVE is disputed. Researchers have claimed that...

CVE-2021-31454

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2021-31454

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2021-31454

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...