CVE-2021-23405

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class...

SQL Injection

django is vulnerable to SQL injection. An attacker is able to inject malicious query via QuerySet.orderby...

GHSA-M738-3RC4-5XV3 A user without PR can reset user authentication failures information

Impact The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights as it should have. Note that being able to reset the authentication failure record mean that an attacker with script right might...

EulerOS Virtualization 3.0.6.6 : PyYAML (EulerOS-SA-2021-2031)

According to the version of the PyYAML package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when...

BNG Gateway For Woocommerce <= 1.6.10 - CSRF Bypass

The plugin does not properly perform CSRF checks, allowing attackers to make logged in users perform unwanted actions, such as add a new billing method to an existing customer, and delete a payment method...

ruby: Code injection via command argument of Shell#test / Shell#[]

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...

Moderate: ruby:2.5 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby 2.5.9. BZ1952626 Security Fixes: ruby: NUL injection vulnerability of...

WS-2021-0174

In spring-framework, versions 4.0.0 to 4.0.1 and 3.0.0 to 3.2.18, are vulnerable against CGLIB memory leak for method injection as a result of mishandled callbacks and non-static classes...

GHSA-7R96-8G3X-G36M Improper Verification of Cryptographic Signature

Impact The verifyWithMessage method of tEnvoyNaClSigningKey always returns true for any signature of a SHA-512 hash matching the SHA-512 hash of the message even if the signature is invalid. Patches Upgrade to v7.0.3 immediately to resolve this issue. Since the vulnerability lies within the...

Improper Verification of Cryptographic Signature

Impact The verifyWithMessage method of tEnvoyNaClSigningKey always returns true for any signature of a SHA-512 hash matching the SHA-512 hash of the message even if the signature is invalid. Patches Upgrade to v7.0.3 immediately to resolve this issue. Since the vulnerability lies within the...

Google Golang injection vulnerability

Google Golang is a static, strongly typed, compiled language from Google.The syntax of Go is close to C, but with differences in variable declarations.Go supports garbage collection.Go's parallel model is based on Tony Hall's Communicating Sequential Processes CSP, and other languages with a...

Security update for ovmf (important)

openSUSE Security Update: Security update for ovmf Announcement ID: openSUSE-SU-2021:0918-1 Rating: important References: 1186151 Affected Products: openSUSE Leap 15.2 An update that contains security fixes can now be installed. Description: This update for ovmf fixes the following issues: - Fixe...

CVE-2021-33348

An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases...

Cross site scripting

An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases...

CVE-2021-33348

An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases...

BadgerYieldSource balanceOfToken share calculation seems wrong

Handle cmichel Vulnerability details When suppling to the BadgerYieldSource, some amount of badger is deposited to badgerSett and one receives badgerSett share tokens in return which are stored in the balances mapping of the user. So far this is correct. The balanceOfToken function should then...

PT-2021-23591 · Unknown · Github.Com/Ecnepsnai/Web

Name of the Vulnerable Software and Affected Versions: github.com/ecnepsnai/web package versions prior to 1.5.2 Description: The issue arises when Web Sockets do not execute any AuthenticateMethod methods, potentially leading to a nil pointer dereference or authentication bypass. This problem...

Amazon Linux 2 : libX11 (ALAS-2021-1661)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1661 advisory. A flaw was found in libX11. An integer overflow leading to a heap-buffer overflow occurs when setuid programs call XIM client...

Design/Logic Flaw

In onCreate of WiFiInstaller.java, there is a possible way to install a malicious Hotspot 2.0 configuration due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...

Auto-merging Person Records Compromised

Impact New user registrations are able to access anyone's account by only knowing their basic profile information name, birthday, gender, etc. This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages such as giving and events. Patches We have...