CVE-2021-21316 Arbitrary code execution in less-openui5

less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be execut...

CVE-2021-21316

CVE-2021-21316 affects the npm package less-openui5 (pre-0.10.0) and can allow arbitrary code execution during build when processing untrusted theming resources (*.less). The vulnerability arises from inline JavaScript evaluation in a forked Less.js v1.6.3 embedded by less-openui5, which is norma...

Less-openui5 Injection Vulnerability

An injection vulnerability exists in Less-openui5, which arises when a network system or product lacks proper validation of user input during the course of an operation to construct a command, data structure, or record, and fails to filter, or fails to correctly filter out, specific elements of t...

CVE-2020-25036

UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell with admin user rights, via an unprotected less command...

CVE-2020-25036

UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell with admin user rights, via an unprotected less command...

Command injection

UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell with admin user rights, via an unprotected less command...

Arbitrary Code Execution

less-openui5 is vulnerable to arbitrary code execution. When processing theming resources i.e. .less files that originate from an untrusted source, the resources may contain JavaScript code which will be executed in the context of the build process...

Processing untrusted theming resources might execute arbitrary code (ACE)

Impact When processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be executed in the context of the build process. While this is a feature of the Less.js library, it is an unexpected behavi...

CVE-2021-23241

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI for authentication bypass to the web server, as demonstrated by the /loginLess/../../etc/passwd URI...

Remote Code Execution(RCE)

firefox is vulnerable to remote code execution RCE. It is possible due to opening an extension-less download which have inadvertently launched an executable instead...

SUSE-SU-2020:3903-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.6.0 ESR Fixed: Various stability, functionality, and security fixes MFSA 2020-55 bsc1180039 CVE-2020-16042 bmo1679003 Operations on a BigInt could have caused uninitialized memory to be exposed...

What's the Value of a Key-Value Store?

A database back end for your application is vital, and odds are that your database is a relational database or a "not only SQL" NoSQL database. Relational databases have dominated the software industry for decades, even as other technologies have radically changed around it. A relational database...

SUSE SLES12 Security Update : less (SUSE-SU-2020:2687-1)

This update for less fixes the following issues : Security issue fixed : CVE-2014-9488: Malformed UTF-8 data could have caused an out of bounds read in the UTF-8 decoding routines, causing an invalid read access bsc921719. Note that Tenable Network Security has extracted the preceding description...

Insecure Cryptography

rclone is vulnerable to insecure cryptography. The vulnerability exists due to the use of an insecure random number generator which produces insecure passwords with much less entropy than advertised...

CVE-2020-12510

The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created with permissions which allow every local user to modify the content. The default installation registers TcSysUI.exe for...

Oracle Solaris Filesystem Authorization Issues Vulnerability

Oracle Solaris is a UNIX operating system from Oracle. An authorization issue vulnerability exists in Oracle Solaris Filesystem version 11 that could allow an attacker to compromise Oracle Solaris by allowing a less-privileged attacker to log in to the infrastructure on which Oracle Solaris is...

Huawei EulerOS: Security Advisory for less (EulerOS-SA-2020-2212)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 3.0.2.2 : less (EulerOS-SA-2020-2212)

According to the version of the less package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - An out of bound read, with a maximum of 5 bytes, was found in the way the isutf8wellformed function parsed UTF-8 characters. If less wa...

Cross site scripting

Multiple stored cross-site scripting XSS vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations Best-fit Mapping, as demonstrated by the full-width variants of the less-than sign...

Interesting Attack on the EMV Smartcard Payment Standard

Its complicated, but its basically a man-in-the-middle attack that involves two smartphones. The first phone reads the actual smartcard, and then forwards the required information to a second phone. That second phone actually conducts the transaction on the POS terminal. That second phone is able...