puppyCMS 安全漏洞

puppyCMS is a very simple, flat file CMS. An arbitrary file deletion vulnerability exists in puppyCMS version 5.1. The vulnerability stems from the fact that there is no path to any restriction. A remote attacker can exploit this vulnerability to delete files/folders via /admin/functions.php...

puppyCMS 安全漏洞

puppetCMS is a small, simple, flat file CMS written in PHP. A remote code execution vulnerability exists in puppyCMS version 5.1. The vulnerability stems from insecure permissions. The vulnerability can be exploited by an attacker via /admin/functions.php as a getshell...

Microsoft Warns of 25 Critical Vulnerabilities in IoT, Industrial Devices

Security researchers at Microsoft are warning the industry about 25 as-yet undocumented critical memory-allocation vulnerabilities across a number of vendors’ IoT and industrial devices that threat actors could exploit to execute malicious code across a network or cause an entire system to crash...

EulerOS 2.0 SP3 : postgresql (EulerOS-SA-2021-1833)

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker havi...

Microsoft SAFER Bypass

Hi @ll, Microsoft introduced SAFER alias Software Restriction Policies SRP with Windows XP about 20 years ago. See for the API, plus the TechNet articles "How Software Restriction Policies Work" and "Using Software Restriction Policies to Protect Against Unauthorized Software" for the use case...

SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database

Impact Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability. Patches This problem has been patched on Laravel...

Insecure Cryptographic Functions

bareos is uses Insecure Cryptographic Functions. The An attacker is able to replay the Bareos director's cram-md5 challenge to the director itself leading to the director responding to the replayed challenge...

SUSE-RU-2021:1414-1 Recommended update for boost-legacy

This update for boost-legacy fixes the following issues: Create a new boost-legacy package with version 1.66.0. bsc1175886, jscSLE-17304, jscECO-3147 - Remove duplicate license package that we get from original Boost - Add a backport of Boost.Optional::hasvalue for LibreOffice - Use %license...

Anyone can list anchors / curate tokens

Handle @cmichelio Vulnerability details Vulnerability Details The Router.listAnchor function can be called by anyone and tokens can be added. The only check is that requireiPOOLSPOOLS.isAnchortoken; but this can easily be set by calling Pools.addLiquidityVADER, token, once even without actually...

CVE-2021-23382

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service ReDoS via getAnnotationURL and loadAnnotation in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /\s sourceMappingURL=...

Apple AirDrop Bug Could Leak Your Personal Info to Anyone Nearby

New research has uncovered privacy weaknesses in Apple's wireless file-sharing protocol that could result in the exposure of a user's contact information such as email addresses and phone numbers. "As an attacker, it is possible to learn the phone numbers and email addresses of AirDrop users – ev...

GPAC 资源管理错误漏洞

GPAC is a multimedia framework for rich media and distributed under the LGPL license. A post-release reuse vulnerability exists in the gfisomboxdel function in isomedia/boxfuncs.c in GPAC versions 0.8.0 and 1.0.1. No detailed vulnerability details are provided at this time...

The vulnerability of the User Experience Monitoring component of the SAP Solution Manager platform allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the User Experience Monitoring component of the SAP Solution Manager software platform is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility ...

Remote Code Execution

getgrav/grav is vulnerable to Remote Code Execution. Twig processing does not prevent dangerous PHP functions from being called in Twig templates by default, allowing an attacker to execute arbitrary code to obtain additional privileges...

SUSE: Security Advisory (SUSE-SU-2017:2326-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:3024-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2016:1791-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-29446

jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed...

CVE-2021-29445

jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed...

CVE-2021-29445

jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed...