postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

ByteDance-HIDS - A Cloud-Native Host-Based Intrusion Detection Solution Project To Provide Next-Generation Threat Detection And Behavior Audition With Modern Architecture

ByteDance-HIDS is a Cloud-Native Host-Based Intrusion Detection solution project to provide next-generation Threat Detection and Behavior Audition with modern architecture. ByteDance-HIDS comprises three major components： ByteDance-HIDS Agent, co-worked with ByteDance-HIDS Driver , is the...

Medium: vim

Issue Overview: A flaw was found in vim in the restricted mode, where all commands that make use of external shells are disabled. However, it was found that users could still execute some arbitrary OS commands in the restricted mode. This flaw was fixed by filtering the functions that can call OS...

Important: postgresql95, postgresql96

Issue Overview: A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text...

Slack: Denial of Service via Hyperlinks in Posts

Summary Via html injection its possible to override all document functions, causing the application to crash because its using the element as a function. Brief explanation of how its possible override document functions with html injection: In some html elements, the name attribute becomes a...

panic safety: double drop or uninitialized drop of T upon panic

Affected versions of this crate did not guard against potential panics that may happen from user-provided functions T::default and T::drop. Panic within T::default leads to dropping uninitialized T, when it is invoked from common::Slice::::new. Panic within T::drop leads to double drop of T, when...

Remote Code Execution (RCE)

dubbo is vulnerable to remote code execution. The vulnerability exists because some functions in the classes stored in HasMap will be executed after a series of program calls via a crafted malicious request...

CVE-2021-3129

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents and fileputcontents. This is exploitable on sites using debug mode with Laravel before 8.4.2. Recent assessments: ccondon-r7...

Crimson Critical Function Missing Authentication Vulnerability

Crimson is a programming software from Red Lion. Crimson suffers from a lack of authentication vulnerability in critical functions. An attacker could exploit this vulnerability to read and modify databases without authentication in the default configuration...

Red Lion Controls Crimson 访问控制错误漏洞

Crimson is a programming software from Red Lion. Crimson suffers from a lack of authentication vulnerability in critical functions. An attacker could exploit this vulnerability to read and modify databases without authentication in the default configuration...

Unauthorized Access Vulnerability in Teaching Information Management System

Teaching Information Management System is a teaching information management system. An unauthorized access vulnerability exists in the Teaching Information Management System. An attacker can exploit the vulnerability by gaining unauthorized direct access to multiple functional pages in the...

CVE-2020-11832

In functions charginglimitcurrentwrite and charginglimittimewrite in /SM8250QMaster/android/vendor/oppocharger/oppo/oppocharger.c have not checked the parameters, which causes a vulnerability...

CVE-2020-17533

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...

CVE-2020-17533

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...

Code injection

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...

CVE-2020-17533 Apache Accumulo Improper Handling of Insufficient Permissions

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...

Cross site request forgery (csrf)

Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery CSRF in many functions, like adding – deleting for hosts or servers...

Command Execution Vulnerability in Smart Store System

Smart Store System is a store management system tailor-made for retail stores by Kingdee Software. There is no need to buy a new machine, and the original cash register equipment can be adapted to the system, which can be used by multiple cash registers, cell phones and computers together to...

Command Execution Vulnerability in Huaan Securities Online Trading Software

hereinafter referred to as "Hua An Securities" was approved by the China Securities Regulatory Commission on December 28, 2000 was incorporated as a securities company, formerly known as the May 1991 establishment of the Anhui Provincial Securities Company, with a registered capital of 2.821...