Advantech iView NetworkServlet getPSInventoryInfo SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetworkServlet class. The issue results from the lack of proper validation o...

Advantech iView NetworkServlet findUpdateDeviceListDetails SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetworkServlet class. The issue results from the lack of proper validation o...

OpenText Brava! Desktop PDF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsin...

PT-2021-25046

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.42 Description A potential security issue exists due to the lack of zero-initialization of the tc skb extension upon allocation. The actual impact and attack plausibility have not yet been proven...

Possible DoS attack when creating Joins in Wand

Handle shw Vulnerability details Impact It is possible for an attacker to intendedly create a fake Join corresponding to a specific token beforehand to make Wand unable to deploy the actual Join, causing a DoS attack. Proof of Concept The address of Join corresponding to an underlying asset is...

CVE-2021-33840: Insufficient Verification of Data Authenticity

The server in Luca through 1.1.14 allows remote attackers to cause a denial of service insertion of many fake records related to COVID-19 because Phone Number data lacks a digital signature...

PT-2021-31000

Open Social is a Drupal distribution for online communities. The included social magic login module doesn't sufficiently validate magic login URLs for user accounts. The lack of validation makes it possible for an adversary to forge valid login URLs and login to such an account. This vulnerabilit...

OpenText Brava! Desktop DWF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsin...

PT-2021-19459

Name of the Vulnerable Software and Affected Versions CHIYU Technology IoT devices, including SEMAC, Biosense, BF-630, BF-631, and Webpass affected versions not specified Description An issue exists due to a lack of sanitization on the "if.cgi" component, specifically the username parameter. This...

PT-2021-15865

Name of the Vulnerable Software and Affected Versions WP Login Security and History WordPress plugin versions prior to 1.1 Description The issue allows attackers to modify the plugin's settings to arbitrary values and set XSS payloads due to the lack of CSRF checks and sanitisation or validation ...

PT-2021-15870

Name of the Vulnerable Software and Affected Versions Content Copy Protection & Prevent Image Save WordPress plugin versions prior to 1.4 Description The issue allows attackers to make a logged-in administrator set arbitrary XSS payloads in the plugin's settings due to the lack of CSRF checks and...

PT-2021-24873

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.37 Description: The issue concerns a lack of proper NULL termination in the secclass map permissions within the selinux component. This problem was introduced in version v4.15 and is fixed in Linux Kernel...

PT-2021-28771

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.12.4 Description The issue concerns a lack of proper NULL termination in the secclass map permissions within the selinux component. This problem was introduced in version v4.15 and is fixed in Linux Kernel...

CVE-2020-25697

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to...

Insecure Cryptographic Functions

github.com/moov-io/customers uses insecure cryptographic function. An attacker is able to exploit the vulnerability by using a rainbow table attack on the system. Th vulnerability exists due to a probability of a lack of uniqueness in the complexity of the hash function...

PT-2021-9141

Name of the Vulnerable Software and Affected Versions zephyr versions = v1.14.2, = v2.2.0 Description The issue is related to improper handling of insufficient permissions or privileges. This can potentially lead to security issues due to the lack of proper access control. Recommendations For...

CVE-2021-25938: Improper Neutralization of Input During Web Page Generation

In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting XSS, since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set, which makes it more susceptible for...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2021-31440

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

Google TensorFlow tf.raw_ops.Dequantize heap out-of-bounds read vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. A heap out-of-bounds read vulnerability exists in Google TensorFlow. The vulnerability stems from a lack of validation in tf.rawops.Dequantize. No detailed vulnerability details are provided at this time...