UBUNTU-CVE-2021-40490

A race condition was discovered in ext4writeinlinedataend in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13...

Telegram Desktop 2.9.2 - Denial of Service Exploit

Exploit Title: Telegram Desktop 2.9.2 - Denial of Service PoC Exploit Author: Aryan Chehreghani Vendor Homepage: https://telegram.org Software Link: https://telegram.org/dl/desktop/win64 Tested Version: 2.9.2 x64 Tested on OS: Windows 10 Enterprise About App Telegram is a messaging app with a foc...

NOTICE of STATUS CHANGE ANNOUNCEMENT FOR NETSCALER Traffic Domain BASED FEATURES & FUNCTIONALITIES

Citrix Systems, Inc. announces a Notice of Status Change NSC for Citrix ADC Traffic Domain features and functionalities.Table 1 below explains Citrix ADC life cycle management milestones as well as important information about dates and options during this period. The dates and milestones provided...

Zoho ManageEngine ADSelfService Plus Access Control Error Vulnerability

ZOHO zoho manageengine adselfservice plus is a web-based end-user password management software from ZOHO. zoho ManageEngine ADSelfService Plus 6103 and earlier versions are vulnerable to an access control error that could be exploited by an attacker via the X The vulnerability can be exploited to...

Authorization Bypass

servicemesh-proxy is vulnerable to authorization bypass. It allows specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed...

CVE-2021-40142

In OPC Foundation Local Discovery Server LDS before 1.04.402.463, remote attackers can cause a denial of service DoS by sending carefully crafted messages that lead to Access of a Memory Location After the End of a Buffer...

CVE-2021-40142

In OPC Foundation Local Discovery Server LDS before 1.04.402.463, remote attackers can cause a denial of service DoS by sending carefully crafted messages that lead to Access of a Memory Location After the End of a Buffer...

GHSA-8928-2FGM-6X9X HTTP Request Smuggling in actix-http

Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling HRS attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also...

HTTP Request Smuggling in actix-http

Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling HRS attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also...

GHSA-HR3H-X6GQ-RQCP Cross site scripting via HTML attributes in the back end

Impact It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview back end and on the website front end. Installations are only affected if there are untrusted back end users who have the rights to modify HT...

HTTP Request Smuggling in actix-http

Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling HRS attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also...

Contact Form Entries < 1.2.1 - Reflected Cross-Site Scripting

The plugin does not escape some of its filters before outputting them back in the admin dashboard, leading to Reflected Cross-Site Scripting issues https://example.com/wp-admin/admin.php?page=vxcfleads&tab=entries&startdate="alert/XSS-startdate/&enddate="alert/XSS-enddate/...

PHP file inclusion via insert tags

Impact It is possible for untrusted users to load arbitrary PHP files via insert tags. Installations are only affected if there are untrusted back end users. Patches Update to Contao 4.4.56, 4.9.18 or 4.11.7. Workarounds Disable the login for untrusted back end users. References...

Critical Flaw Found in Older Cisco Small Business Routers Won't Be Fixed

A critical vulnerability in Cisco Small Business Routers will not be patched by the networking equipment giant, since the devices reached end-of-life in 2019. Tracked as CVE-2021-34730 CVSS score: 9.8, the issue resides in the routers' Universal Plug-and-Play UPnP service, enabling an...

Critical Cisco RCE Bug in Small Business Routers to Remain Unpatched

A critical security vulnerability in Cisco Small Business Routers RV110W, RV130, RV130W and RV215W models allows remote code execution RCE and denial of service DoS. The networking giant said that no patch or workaround will be coming for the bug, since the routers reached end-of-life back in 201...

Cisco Small Business routers vulnerable to remote attacks, won’t get a patch

In a security advisory, Cisco has informed users that a vulnerability in the Universal Plug-and-Play UPnP service of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart...

CVE-2021-32728

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a privat...

DEBIAN-CVE-2021-32728

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a privat...

CVE-2021-32728

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a privat...

CVE-2021-32728 End-to-end encryption device setup did not verify public key

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a privat...