CVE-2021-38155

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...

Information disclosure

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...

CVE-2021-38155

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...

CVE-2021-38155

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...

CVE-2021-38155

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...

CVE-2021-36542

Cross-Site Request Forgery CSRF vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x5.1.23 and v6.0.x 6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x5.1.23 and v6.0.x 6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page...

CVE-2021-36542

CVE-2021-36542 is a CSRF vulnerability in SeedDMS affecting op/LockDocument.php for SeedDMS 5.1.x below 5.1.23 and 6.0.x below 6.0.16. An authenticated user who visits a malicious page can cause the application to lock any document without the user’s knowledge. The NVD entry documents a CVSSv3.1 ...

CVE-2021-36542

Cross-Site Request Forgery CSRF vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x5.1.23 and v6.0.x 6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page...

GHSA-9Q94-V7CH-MXQW Insufficient Session Expiration and TOCTOU Race Condition in OPC FOundation UA .Net Standard

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results fr...

Insufficient Session Expiration and TOCTOU Race Condition in OPC FOundation UA .Net Standard

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results fr...

CVE-2021-24484

The getreports function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

Sql injection

The getreports function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24484

The CVE-2021-24484 entry concerns the WordPress plugin Secure Copy Content Protection and Content Locking (versions before 2.6.7). The vulnerability arises in the plugin’s get_reports() function, which did not whitelist/validate the orderby parameter before it is used in SQL statements passed to ...

CVE-2021-3667

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited...

3xlogic 3xLogic Infinias eIDC32 信任管理问题漏洞

The 3xlogic 3xLogic Infinias eIDC32 is an access control controller from 3xLogic 3xlogic USA. A security vulnerability exists in the 3xLogic Infinias eIDC32, which allows an attacker to exploit the vulnerability to intercept channels that control the application of door locking policies...

CVE-2021-2402

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Locking. Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attac...

UBUNTU-CVE-2021-2402

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Locking. Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attac...

SUSE SLED15: caribou / caribou-common / caribou-devel / etc (SUSE-SU-2021:2414-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2414-1 advisory. Security issue fixed: - CVE-2021-3567: Fixed a segfault when attempting to use shifted characters bsc1186617. Tenable has extracted the precedi...

Oracle MySQL Server Denial of Service Vulnerability (CNVD-2021-54391)

Oracle MySQL is an open source relational database management system from Oracle Corporation. A denial-of-service vulnerability exists in the Server: Locking component of Oracle MySQL Server 8.0.25 and earlier versions. An attacker can exploit this vulnerability to cause MySQL Server to hang or...