17647 matches found
Out-of-bounds
In oggpacklook of bitwise.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-1698297...
CVE-2021-0452
The CVE-2021-0452 entry concerns the Titan M chip firmware. It describes a stack memory disclosure due to uninitialized data, enabling local information disclosure with system privileges required. Exploitation is described as local with no user interaction needed. The issue is tied to Android ker...
CVE-2021-0382
CVE-2021-0382 affects Android 11 where SliceManagerService.java’s checkSlicePermission allows local information disclosure due to an incorrect permission check. Exploitation would be local (no user interaction) and could expose partial to sensitive information as defined in the CVE entry. Red Hat...
CVE-2020-13936
CVE-2020-13936 affects Apache Velocity, where modifying Velocity templates can bypass the sandbox and allow remote code execution with the container’s privileges. Engine versions affected include up to 2.2; IBM and related advisories flag this as a Velocity sandbox bypass leading to arbitrary cod...
Weak Password Vulnerability in Zhongxin Golden Shield Information Security Management System
Zhongxin Golden Shield Information Security Management System adopts distributed data collection, intelligent packet reorganization and flow reorganization, adaptive in-depth protocol analysis, real-time network protocol blocking, massive data storage, in-depth data mining and other advanced...
CVE-2021-21177
Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page...
CVE-2021-22134
A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been...
Domain dumpster diving
By Jaeson Schultz. Dumpster diving — searching through the trash looking for items of value — has long been a staple of hacking culture. In the 1995 movie "Hackers," Acid Burn and Crash Override are seen dumpster diving for information they can use to help them "hack the Gibson." Of course, not a...
TP-COUPON suffers from SQL injection vulnerability (CNVD-2021-23515)
TP-COUPON is a free and open source coupon system developed using the Thinkphp framework. TP-COUPON suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...
JPress has a flawed logic vulnerability
JPress is a product developed using Java, similar to WordPress. JPress has a logic flaw vulnerability that can be exploited by attackers to obtain sensitive information...
CVE-2021-23128
CVE-2021-23128 affects Joomla! core 3.2.0 through 3.9.24, where the unused FOFEncryptRandval path used an insecure randval implementation. The issue has been mitigated by replacing that code with a call to random_bytes() and its backport shipped in random_compat. Multiple connected sources confir...
CVE-2020-29047
creationtimestamp| type| source ---|---|--- 2021-03-03 20:45:55+00:00| seen| https://t.me/cibsecurity/24415 2025-05-31 21:02:18+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lqingbu3fr2s...
SQL injection vulnerability exists in yycms (CNVD-2021-21894)
yycms is a movie and television system. yycms suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...
User Profile Picture < 2.5.0 - Sensitive Information Disclosure
The REST API endpoint getusers in the plugin returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information. PoC Usage: php poc.php auth...
2034, Part VI: Crossing the Red Line
“Eventually, the Americans would find them. But by then it would be too late.”...
CVE-2021-27904
The CVE-2021-27904 issue affects MISP 2.4.139, specifically in app/Model/SharingGroupServer.php within the Sharing Groups implementation. The root cause is that the implementation of the "all org" flag can grant view access to unintended actors, exposing sensitive information to unauthorized part...
Tiny Tiny RSS - Remote Code Execution
Exploit Title: Tiny Tiny RSS - Remote Code Execution Date: 21/09/2020 Exploit Author: Daniel Neagaru & Benjamin Nadarević Blog post: https://www.digeex.de/blog/tinytinyrss/ Software Link: https://git.tt-rss.org/fox/tt-rss Version: all before 2020-09-16 Commit with the fixes:...
