Design/Logic Flaw

NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection...

Zhiyuan G6 Government Collaboration System 跨站脚本漏洞

Zhiyuan G6 Government Collaboration System is an application system of China Zhiyuan Company. It is used to connect and integrate front-end and back-end scenario-based business applications. A cross-site scripting vulnerability exists in Zhiyuan G6 Government Collaboration System V6.1SP1, which...

CVE-2021-20289

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

UBUNTU-CVE-2021-20289

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

CVE-2021-20289

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

GetSimple CMS Custom JS 0.1 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: GetSimple CMS Custom JS Plugin 0.1 - CSRF to Persistent XSS Exploit Author: Abhishek Joshi Date: March 25, 2021 Vendor Homepage: http://get-simple.info/extend/plugin/custom-js/1267 / http://get-simple.info/download Software Link:...

GHSA-8MRF-64FW-2X75 Command injection in fs-path

fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the copy, copySync, remove, and removeSync methods...

March 25, 2021—KB5000850 (OS Build 18363.1474) Preview

None None...

openSUSE Security Update : grub2 (openSUSE-2021-462)

This update for grub2 fixes the following issues : grub2 implements the new 'SBAT' method for SHIM based secure boot revocation. bsc1182057 - CVE-2020-25632: Fixed a use-after-free in rmmod command bsc1176711 - CVE-2020-25647: Fixed an out-of-bound write in grubusbdeviceinitialize bsc1177883 -...

The vulnerability of the “Commons Compress” compression tool’s reading method, related to the infinite loop that allows a hacker to cause a service failure.

The vulnerability of the “toolset for compressing Commons” reading method is related to an error during the return of the EOF indicator. Exploiting this vulnerability could allow an attacker to cause a service failure...

Denial Of Service (DoS)

etcd is vulnerable to denial of service DoS. It does not handle the case when an entry index is greater then the number of entries in the ReadAll method in wal/wal.go, leading to issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant and causing a runti...

CVE-2021-20289

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

The vulnerability of the jqMix method implementation in the dojox library (NPM package) allows an attacker to compromise data integrity.

The vulnerability of the jqMix method implementation in the dojox library NPM package is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the data...

USN-4754-3 python2.7, python3.7, python3.8 vulnerabilities

USN-4754-1 fixed vulnerabilities in Python. This update provides the corresponding updates for Ubuntu 18.04 and Ubuntu 20.04. In the case of Python 2.7 for 20.04, these additional fixes are included: It was dicovered that Python allowed remote attackers to cause a denial of service resource...

Huawei EulerOS: Security Advisory for libX11 (EulerOS-SA-2021-1662)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-14989

An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows CSRF if the attacker uses GET where POST was intended...

Cross site request forgery (csrf)

An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows CSRF if the attacker uses GET where POST was intended...

Arbitrary Code Execution

tenable-jira-cloud is vulnerable to arbitrary code execution. An attacker with local access to the host is able to run arbitrary commands through the yaml.load method by running the application with a malicious YAML file...

AZL-79104 CVE-2021-27918 affecting package golang 1.25.7-1

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader for xml.NewTokenDecoder returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method...

Design/Logic Flaw

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader for xml.NewTokenDecoder returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method...