CVE-2021-34802

A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands with elevated privileges...

Charm 加密问题漏洞

Charm is Charm is a framework for rapidly prototyping advanced cryptosystems. A cryptographic issue vulnerability exists in Charm version 0.43. Using this vulnerability any single user can decrypt DAC-MACS or MA-ABE-YJ14 data...

CVE-2021-20363

IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195034...

IBM Cloud Pak for Applications安全漏洞

IBM Cloud Pak for Applications is an application from IBM America, Inc. Provides cloud-native development solutions that deliver value quickly. A security vulnerability exists in IBM Cloud Pak for Applications v4.3, which can be exploited by attackers to obtain sensitive information...

CVE-2021-32644

Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code injection in random.php. The attack requires user authentication to access the random.php page unless the site is running in demo mode. Th...

DEBIAN-CVE-2021-20237

An uncontrolled resource consumption memory leak flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remote unauthenticated attacker to send crafted PUB messages that consume excessive memory if the CURVE/ZAP authentication is disabled on the server, causing a...

PT-2021-4448 · Nginx +5 · Nginx +5

Name of the Vulnerable Software and Affected Versions: Puma versions prior to 4.3.8 Puma versions prior to 5.3.1 Description: The issue is related to an incomplete fix for a previous problem, which allowed greedy persistent-connections to saturate all threads in the cluster, potentially starving...

多款 Siemens 设备资源管理错误漏洞

Siemens SIMATIC is a Siemens Siemens configuration software. A resource management error vulnerability exists in multiple Siemens devices. An attacker could send specially crafted packets that would result in a denial of service condition on TCP port 102. The following products and versions are...

CVE-2021-31571

The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation...

OPENSUSE-SU-2021:0567-1 Security update for chromium

This update for chromium fixes the following issues: - Chromium 89.0.4389.128 boo1184700: CVE-2021-21206: Use after free in blink CVE-2021-21220: Insufficient validation of untrusted input in v8 for x8664...

ZeroMQ 资源管理错误漏洞

0MQ ZeroMQ is 0MQ an open source application . Provides sockets that can carry atomic messages across a variety of transports e.g., intra-process, inter-process, TCP, and multicast. A resource management error vulnerability exists in versions of ZeroMQ prior to 4.3.3, which can be exploited by an...

PT-2021-14419

Name of the Vulnerable Software and Affected Versions fastify-http-proxy versions prior to 4.3.1 Description The issue allows an attacker to escape the prefix of the proxied backend service by crafting a specific URL. For example, if the base URL of the proxied server is /pub/, an attacker can...

CVE-2020-24455

Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before 3.0.1 and before 2.4.3...

CVE-2020-4747

IBM Connect:Direct for UNIX 6.1.0, 6.0.0, 4.3.0, and 4.2.0 can allow a local or remote user to obtain an authenticated CLI session due to improper authentication methods. IBM X-Force ID: 188516...

SAP BusinessObjects Business Intelligence Platform XML External Entity Injection Vulnerability

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product features report generation, analytics and data visualization. An XML external entity injection vulnerability exists in SAP BusinessObjects...

libslirp 缓冲区错误漏洞

libslirp is a general-purpose TCP-IP emulator for managing virtual network services in a hypervisor. A buffer over-read vulnerability exists in ncsi.c in libslirp 4.3.1 and earlier versions, which stems from ncsi.c attempting to read a certain amount of header data despite having exceeded the tot...

PT-2020-19852 · Mongodb · Mongodb Ops Manager

Name of the Vulnerable Software and Affected Versions: MongoDB Ops Manager versions prior to and including 4.2.17 MongoDB Ops Manager versions prior to and including 4.3.9 MongoDB Ops Manager versions prior to and including 4.4.2 Description: Specially crafted API calls may allow an authenticated...

QNAP Systems TS-870 Cross-Site Scripting Vulnerability (CNVD-2020-62488)

QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site scripting vulnerability exists in the QNAP Systems TS-870 using firmware version 4.3.4.0486. The vulnerability stems from a lack of proper validation of client data by the WEB application...

BaserCMS Cross-Site Scripting Vulnerability (CNVD-2020-49925)

BaserCMS is an open source enterprise-level content management system cms. A cross-site scripting vulnerability exists in baserCMS 4.3.6 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary scripts...

SAP Business Objects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2020-48591)

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. A cross-site scripting vulnerability exists in SAP Business Objects...