Oracle Application Testing Suite (Apr 2021 CPU)

The 13.3.0.1 versions of Application Testing Suite installed on the remote host are affected by a vulnerability as referenced in the April 2021 CPU advisory. - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager component: Load Testing for Web Apps OpenCV. T...

GHSA-3PQX-4FQF-J49F Deserialization of Untrusted Data in PyYAML

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and loadall functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342...

Deserialization of Untrusted Data in PyYAML

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and loadall functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342...

SUSE: Security Advisory (SUSE-SU-2019:1241-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 5.10.30 and fixes at least the following security issues: nfc: fix refcount leak in llcpsockbind CVE-2020-25670 nfc: fix refcount leak in llcpsockconnect CVE-2020-25671 nfc: fix memory leak in llcpsockconnect CVE-2020-25672 firewire: nosy: Fix a...

EulerOS Virtualization 2.9.0 : binutils (EulerOS-SA-2021-1760)

According to the version of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Load value injection in some IntelR Processors utilizing speculative execution may allow an authenticated user to potentially enabl...

Command Execution Vulnerability in DrayTek Vigor2960 (CNVD-2021-28719)

Vigor2960 is a load balancing router and VPN gateway appliance from DrayTek Taiwan, China. The DrayTek Vigor2960 suffers from a command execution vulnerability that can be exploited by an attacker to gain ROOT privileges...

Huawei EulerOS: Security Advisory for binutils (EulerOS-SA-2021-1732)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2021-30184

GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN Portable Game Notation data. This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmdpgnload and cmdpgnreplay functions in frontend/cmd.cc...

CVE-2021-25371

A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP...

CVE-2020-6787

Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Client installer up to and including version 1.7.6.079 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same...

Apache PDFBox 安全漏洞

Apache PDFBox is the United States Apache Apache Foundation of a Java-based open source language tool library . The product provides PDF document creation and editing and other functions. Apache PDFBox has a security vulnerability that stems from the fact that a carefully crafted PDF file can...

CVE-2021-24140

Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep5&type=test...

CVE-2021-24140

Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep5&type=test...

Sql injection

Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep5&type=test...

CVE-2021-24140

The CVE-2021-24140 issue affects the WordPress plugin “Ajax Load More” (versions prior to 5.3.2). An unvalidated input path in POST /wp-admin/admin-ajax.php, via param repeater=' or sleep(5)# (and related payloads), enables SQL injection. Some sources note that exploitation requires authenticatio...

CVE-2021-24140 Ajax Load More < 5.3.2 - Authenticated SQL Injection

Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep5&type=test...

Wordpress Load More SQL注入漏洞

Wordpress Load More is Wordpress an open source application plugin . Provide a load more items function . WordPress Load More plugin before 5.3.2 SQL injection vulnerability exists , the vulnerability stems from /wp-admin/admin-ajax.php repeater parameter or type=test parameter...

CVE-2020-29045

The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdmcart cookie in loadcartfromcookie in includes/class-cart-manager.php...

Arbitrary Code Execution

tenable-jira-cloud is vulnerable to arbitrary code execution. An attacker with local access to the host is able to run arbitrary commands through the yaml.load method by running the application with a malicious YAML file...