PT-2021-4377 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to an information disclosure vulnerability in the Windows operating system. It allows attackers to obtain sensitive information and potentially affect the system. There...

Zammad Information Disclosure Vulnerability (CNVD-2021-81953)

Zammad is an open source web-based help desk/customer support system. versions prior to Zammad 4.1.1 are vulnerable to information disclosure. An attacker could exploit the vulnerability to obtain sensitive information via the REST API...

CVE-2021-37963

Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass site isolation via a crafted HTML page...

DEBIAN-CVE-2021-41133

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AFUNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services int...

CVE-2021-41133

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AFUNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services int...

PT-2021-27835

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read issue is identified, potentially causing a crash. The crash involves the Imf 3 1::memstream read, dispatch read, and exr read...

Online Traffic Offense Management System 1.0 - Multiple RCE (Unauthenticated)

Exploit Title: Online Traffic Offense Management System 1.0 - Multiple RCE Unauthenticated Date: 07/10/2021 Exploit Author: Hubert Wojciechowski Contact Author: [email protected] Vendor Homepage: https://www.sourcecodester.com Software Link:...

CVE-2021-0685

In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-0682

CVE-2021-0682 affects Android via a permissions check gap in NotificationManagerService.java (sendAccessibilityEvent), enabling local information disclosure of notifications. Affected: Android 8.1, 9, 10, 11. Exploitation: local, requires no user interaction, per description; no mitigation detail...

ConcentratedLiquidityPoolManager: incentive is incorrectly accessed

Handle hickuphh3 Vulnerability details Impact The positionId is used to retrieve the incentive info instead of incentiveId. Incentive storage / memory incentive = incentivesposition.poolpositionId; Recommended Mitigation Steps Incentive storage / memory incentive =...

CVE-2021-39891

In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure...

Information disclosure

In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure...

CVE-2021-39891

In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure...

CVE-2021-39891

In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure...

CVE-2021-39891

Removed by vendor...

CVE-2021-39891

CVE-2021-39891 affects GitLab CE/EE from version 8.0 onward, where tokens created during an admin’s impersonation of a user are not cleared at the end of impersonation. This can lead to exposure of sensitive information if impersonation tokens persist. The available documents consistently describ...

CVE-2021-39888

Removed by vendor...

CVE-2020-21386

A Cross-Site Request Forgery CSRF in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges...

Semrush: php info file and sql backup at vendor's subdomain

Researcher found open /phpinfo.php and sql backup from mvp app at vendor's subdomain. There was no sensitive data...

Maccms Cross-Site Request Forgery Vulnerability

Maccms is a PHP-based content management system CMS for film and television. A cross-site request forgery vulnerability exists in Macmms 10, which stems from the failure of the admin.php/admin/type/info.html page in the product to verify that requests originate from trusted users. An attacker cou...