PT-2021-23497 · Sap · Sap Knowledge Warehouse

Name of the Vulnerable Software and Affected Versions: SAP Knowledge Warehouse versions 7.30 through 7.50 Description: A security issue has been discovered that enables unauthorized attackers to conduct XSS attacks, potentially leading to the disclosure of sensitive data. This is due to the usage...

PT-2021-5695 · Microsoft · Windows Common Log File System Driver +1

Name of the Vulnerable Software and Affected Versions: Windows Common Log File System Driver affected versions not specified Description: The issue is related to insufficient access control in the Windows Common Log File System Driver of the Windows operating system. Exploitation of this issue ma...

CVE-2021-43814

Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parsedie when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin ma...

CVE-2021-43814

Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parsedie when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin ma...

CVE-2021-43814

Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parsedie when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin ma...

Malicious PyPI Code Packages Rack Up Thousands of Downloads

Three malicious packages hosted in the Python Package Index PyPI code repository have been uncovered, which collectively have more than 12,000 downloads – and presumably slithered into installations in various applications. Independent researcher Andrew Scott found the packages during a nearly...

Insecure Access Control

snipe/snipe-it is vulnerable to improper access control. The vulnerability exists because it does not perform sufficient user permissions, allowing users to view model information via clone endpoint...

PT-2021-24048 · Reprise · Reprise Rlm

Name of the Vulnerable Software and Affected Versions: Reprise RLM version 14.2 Description: An issue was discovered in Reprise RLM where session cookies are small, allowing an attacker to hijack existing sessions by bruteforcing the 4 hex-character session cookie on the Windows version. The Linu...

Simple Forum-Discussion System 1.0 SQL Injection Vulnerability

Simple Forum-Discussion System 1.0 Vendor Description: Multiple SQL-Injections are found on Simple Forum-Discussion System 1.0 For example on three applications which are managetopic.php, manageuser.php, and ajax.php. The attacker can be retrieving all information from the database of this system...

PT-2021-9867 · Unknown +2 · Cpan::Checksums +2

Name of the Vulnerable Software and Affected Versions: CPAN::Checksums version 2.12 Description: The issue concerns the CPAN::Checksums package for Perl, which does not uniquely define signed data. This could potentially lead to security issues, although specific details about exploitation or...

CVE-2021-43814: Out-of-bounds Write

Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parsedie when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin ma...

airtube.info Cross Site Scripting vulnerability OBB-2297322

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-37077

creationtimestamp| type| source ---|---|--- 2021-12-07 20:21:51+00:00| seen| https://t.me/cibsecurity/33476...

SolarWinds Attackers Spotted Using New Tactics, Malware

One year after the notorious and far-reaching SolarWinds supply-chain attacks, its orchestrators are on the offensive again. Researchers said they’ve seen the threat group – which Microsoft refers to as “Nobelium” and which is linked to Russia’s spy agency – compromising global business and...

KLA12376 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information, cause denial of service, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1...

KLA12374 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to spoof user interface, perform cross-site scripting attack, obtain sensitive information, cause denial of service, bypass security restrictions, execute arbitrary code. Below is a complete...

KLA12375 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information, cause denial of service, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Group members with developer role can escalate their privilege to maintainer on projects that they import When user registration is limited, external users that aren't developers shouldn't have access to the CI Lint API Collision in access memoization leads to potential elevated...

CVE-2021-43683

pictshare v1.5 is affected by a Cross Site Scripting XSS vulnerability in api/info.php. The exit function will terminate the script and print the message which has $REQUEST'hash'...

Jenkins Report Info XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Jenkins Report Info. Authentication is required to exploit this vulnerability. The specific flaw exists within the PMD class. Due to the improper restriction of XML External Entity XXE...