Security Bulletin: Multiple vulnerabilities in WebSphere Application Server affect IBM Rational products based on IBM Jazz technology

Summary Multiple vulnerabilities in WebSphere Application Server traditional bundled with IBM Jazz Team Server based Applications affect the following products: Collaborative Lifecycle Management CLM, Rational DOORS Next Generation RDNG, Rational Engineering Lifecycle Manager RELM, Rational Team...

CVE-2020-18020

SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "userphone" parameter of a crafted HTTP request to the "admin.php" component...

CVE-2021-22660

CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code...

CVE-2021-20708

NEC Aterm devices Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allow authenticated attackers to execute arbitrary OS commands by sending a specially crafted request to a specific URL...

Server side request forgery (ssrf)

A server-side request forgery SSRF vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer...

Input validation

A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of improper classes. This issue affects: Tobesoft XPlatform versions prior to 9.2.2.280...

Buffer overflow

Buffer overflow in the abstboxread function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file...

CVE-2021-31254

CVE-2021-31254 describes a buffer overflow in GPAC’s MP4Box tenc_box_read function (GPAC 1.0.1). A crafted file with related invalid IV sizes can cause a denial of service or allow execution of arbitrary code. The vulnerability is tied to GPAC 1.0.1; no other product/version details are provided ...

CVE-2021-31255

Buffer overflow in the abstboxread function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file...

Adobe Bridge Memory Corruption Vulnerability (CNVD-2021-30418)

Adobe Bridge is a free digital asset management application from Adobe. A memory corruption vulnerability exists in Adobe Bridge. An attacker could exploit the vulnerability to execute arbitrary code...

Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-4912-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4912-1 advisory. Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux kernel did not properly validate computation of branch displacements in some...

Adobe Photoshop Buffer Overflow Vulnerability (CNVD-2021-30425)

Adobe Photoshop is a set of image processing software from the American company Audobee Adobe. The software is mainly used for processing pictures. A buffer overflow vulnerability exists in Adobe Photoshop. An attacker can exploit this vulnerability to execute arbitrary code...

Adobe Bridge out-of-bounds write vulnerability (CNVD-2021-30416)

Adobe Bridge is a free digital asset management application from Adobe. Adobe Bridge suffers from an out-of-bounds write vulnerability. An attacker could exploit the vulnerability to execute arbitrary code...

Ubuntu: Security Advisory (USN-4909-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for open-iscsi (EulerOS-SA-2021-1762)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2021-2638 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue is related to insecure privilege management in the Hyper-V component of the Windows operating system. Exploitation of this issue may allow a remote attacker to execute...

Valve Steam 缓冲区错误漏洞

Valve Steam is a suite of game distribution management platforms from Valve Corporation in the United States. The platform provides digital rights management, multiplayer, streaming, and social networking services. A buffer overflow vulnerability exists in Valve Steam version 2021-04-10 and earli...

CVE-2020-23761

Cross Site Scripting XSS vulnerability in subrion CMS Version = 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab...

Information disclosure

Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these vulnerabilities, see the Details secti...

Cisco Link Layer Discovery Protocol 缓冲区错误漏洞

Cisco Link Layer Discovery Protocol is a router from Cisco USA. A buffer overflow vulnerability exists in Cisco Link Layer Discovery Protocol, which can be exploited by an unauthenticated, neighboring attacker to execute arbitrary code...