GitLab Information Disclosure Vulnerability (CNVD-2021-91179)

GitLab is a self-hosted Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. GitLab CE/EE is vulnerable to an information disclosure vulnerability that stems from the fact that project exports can reveal external webhook token values, which can be...

GitLab Access Control Error Vulnerability (CNVD-2021-91178)

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. The application can be used to access a project's file content, commit history, bug list, etc. An access control error vulnerability exists in GitLab CE/EE, which can be...

Huawei Emui and Magic UI Denial of Service Vulnerabilities

Huawei Emui is a mobile operating system based on Android.Magic Ui is a mobile operating system based on Android.Magic Ui is a mobile operating system based on Android.Magic Ui is a mobile operating system based on Android.Magic Ui is a mobile operating system based on Android.Magic Ui is a mobil...

Huawei Emui and Magic UI tampering kernel vulnerability (CNVD-2021-83525)

Huawei Emui is a mobile operating system developed based on Android.Magic Ui is a mobile operating system developed based on Android. Huawei Emui and Magic UI have security vulnerabilities that can be exploited by attackers to elevate privileges...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-91184)

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features.GitLab CE/EE is vulnerable to a cross-site scripting vulnerability that could b...

Huawei Emui and Magic UI Registration Tampering Vulnerability

Huawei Emui is a mobile operating system developed based on Android.Magic Ui is a mobile operating system developed based on Android. A security vulnerability exists in Huawei Emui and Magic UI, which can be exploited by attackers to modify registry values...

CVE-2021-37997

creationtimestamp| type| source ---|---|--- 2021-10-29 16:50:00+00:00| exploited| https://t.me/truesecator/2268...

Google Releases Urgent Chrome Update to Patch 2 Actively Exploited 0-Day Bugs

Google on Thursday rolled out an emergency update for its Chrome web browser, including fixes for two zero-day vulnerabilities that it says are being actively exploited in the wild. Tracked as CVE-2021-38000 and CVE-2021-38003, the weaknesses relate to insufficient validation of untrusted input i...

DNN (DotNetNuke) 9.2 <= 9.2.2 Weak Encryption Algorithm Vulnerability

The version of DNN Platform formerly DotNetNuke running on the remote host is 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Apache HTTP Server Path Traversal & Remote Code Execution (CVE-2021-41773 & CVE-2021-42013)

On October 4, 2021, Apache HTTP Server Project released Security advisory on a Path traversal and File disclosure vulnerability in Apache HTTP Server 2.4.49 and 2.4.50 tracked as CVE-2021-41773 and CVE-2021-42013. In the advisory, Apache also highlighted “the issue is known to be exploited in the...

Apple Patches Critical iOS Bugs; One Under Attack

Apple lovers who haven’t yet updated to iOS 15, you may want to pop into Settings to freshen up your iPhone now: Apple has released several critical security updates that might light a fire under your britches. On Monday and Tuesday, Apple released iOS 14.8.1, iPadOS 14.8.1, watchOS 8.1 and tvOS...

CVE-2021-41872

Skyworth Digital Technology Penguin Aurora Box 41502 has a denial of service vulnerability, which can be exploited by attackers to cause a denial of service...

Adobe Character Animator 2021 Memory Corruption Vulnerability (CNVD-2022-67832)

Adobe Character Animator is a motion capture and animation tool from Adobe. Adobe Character Animator 2021 4.4 and earlier versions contain a memory corruption vulnerability that could be exploited by attackers to execute arbitrary code in the context of the current user...

Adobe Lightroom Classic Elevation of Privilege Vulnerability

Adobe Lightroom Classic is a suite of graphics processing software from Adobe.Adobe Lightroom Classic 10.3 and earlier versions contain an elevation of privilege vulnerability that could be exploited by attackers to execute arbitrary code in the context of the current user...

Adobe Bridge Memory Corruption Vulnerability (CNVD-2022-67851)

Adobe Bridge is a free digital asset management application from Adobe. 11.1.1 and earlier versions of Adobe Bridge contain a memory corruption vulnerability that could be exploited by attackers to execute arbitrary code in the context of the current user...

Adobe Audition Arbitrary Code Execution Vulnerability (CNVD-2022-00590)

Adobe Audition is an audio editor and post-production suite. Adobe Audition 14.4 and earlier versions contain an arbitrary code execution vulnerability that could be exploited by attackers to execute arbitrary code...

GHSA-4286-H47H-M5V6 Showdoc File Upload Vulnerability

A file upload vulnerability exists in Showdoc 2.8.3, which can be exploited by an attacker to gain server privileges...

Prometheus Unauthorized Access Vulnerability

Prometheus is an open source event control and solution. prometheus unauthorized access vulnerability can be exploited by attackers to obtain sensitive information, /api/v1/status/flags of web.enable-admin-api and web-enable-lifecycle if True can shut down the service or delete all endpoints...

Age Gate < 2.17.1 - Unauthenticated Import Settings

The plugin patched an Unauthenticated Import Settings vulnerability. It was found to be exploited in the wild a few days after being patched...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2021-81105)

DedeCMS Dream Weaving Content Management System is a set of simple, robust, flexible, open source several characteristics of open source content management system. DedeCMS has a cross-site scripting vulnerability that can be exploited to inject malicious script code via the filename, mid, userid ...