MagicMotion Flamingo has an unspecified vulnerability (CNVD-2021-60542)

MagicMotion Flamingo, a wearable vibrator from China-based MagicMotion, has a security vulnerability in MagicMotion Flamingo 2, which stems from the lack of BLE encryption in MagicMotion Flamingo 2. An attacker could exploit the vulnerability to sniff data and spoof packets...

CVE-2021-34828

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the SOAPAction HTTP header. The issue...

Design/Logic Flaw

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the SOAPAction HTTP header. The issue...

CVE-2021-34828

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the SOAPAction HTTP header. The issue...

Adobe Acrobat Reader DC setAction Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2021-31895: Buffer Copy without Checking Size of Input

A vulnerability has been identified in RUGGEDCOM i800 All versions V4.3.7, RUGGEDCOM i801 All versions V4.3.7, RUGGEDCOM i802 All versions V4.3.7, RUGGEDCOM i803 All versions V4.3.7, RUGGEDCOM M2100 All versions V4.3.7, RUGGEDCOM M2200 All versions V4.3.7, RUGGEDCOM M969 All versions V4.3.7,...

CVE-2021-32741

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in...

CVE-2021-32703 Lack of ratelimit on shareinfo endpoint

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13,...

CVE-2021-32703

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13,...

Lack of ratelimit on public DAV endpoint

None...

CVE-2021-32703: Improper Control of Interaction Frequency

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13,...

PT-2021-15901

Name of the Vulnerable Software and Affected Versions Admin Columns WordPress plugin Free versions prior to 4.3.2 Admin Columns WordPress plugin Pro versions prior to 5.5.2 Description The issue allows configuration of individual columns for tables, with a column type of "Custom Field" enabling t...

Top 10 Cloud security tips

About half of the pen tests we’re asked to do involved cloud services at some point. We’ve even tested a cloud platform on an aeroplane – the irony was not lost on us! There is a multitude of ways to improve the security of your cloud platforms and often those ways are ever-changing or obscured...

Google TensorFlow suffers from an unspecified vulnerability (CNVD-2021-48856)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Google TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4, which stems from a lack of validation in tf.rawops.RaggedTensorToTensor, and can be exploited by an...

PT-2021-13979

Name of the Vulnerable Software and Affected Versions: IBM Guardium Data Encryption GDE versions 3.0.0.2 through 4.0.0.4 Description: The issue concerns a lack of authentication for certain functionality that requires a provable user identity or consumes significant resources. Recommendations: Fo...

CVE-2021-24375

Lack of authentication or validation in motorloadmore, motorgalleryloadmore, motorquickview and motorprojectquickview AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php script...

CVE-2021-23403

All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge function due to lack of validation input...

CVE-2021-23403

All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge function due to lack of validation input...

PT-2021-15494

Name of the Vulnerable Software and Affected Versions ts-nodash versions prior to 1.2.7 Description The issue is related to Prototype Pollution via the Merge function due to a lack of validation input. This affects the ts-nodash package. Recommendations For versions prior to 1.2.7, update to...

CVE-2021-23403: Improperly Controlled Modification of Object Prototype Attributes

All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge function due to lack of validation input...