UBUNTU-CVE-2021-39213

GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API bypass with custom header injection. This issue is fixed in version 9.5.6. One may disable API Rest as a workaround...

CVE-2021-23050

On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery CSRF-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to...

Adobe Experience Manager 输入验证错误漏洞

Adobe Experience Manager is an enterprise content management solution that helps you simplify the management and delivery of content and assets. Adobe Experience Manager CS, version 6.5.10.0 is vulnerable to improper input validation. An attacker could exploit this vulnerability to cause a denial...

CVE-2021-3049

An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of. This issue impacts: All Cortex...

CVE-2021-1807

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 14.5 and iPadOS 14.5, watchOS 7.4. A local user may be able to write arbitrary files...

PT-2021-13608 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.5 iPadOS versions prior to 14.5 tvOS versions prior to 14.5 Description: A logic issue was addressed with improved restrictions, allowing a local user to potentially create or modify privileged files. Recommendations:...

CVE-2021-3581

Buffer Access with Incorrect Length Value in zephyr. Zephyr versions = =2.5.0 contain Buffer Access with Incorrect Length Value CWE-805. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8q65-5gqf-fmw5...

Yzmcms 代码问题漏洞

YzmCMS is a lightweight open source content management system based on PHP Mysql architecture developed solely by Yuan Zhimeng. a server-side request forgery vulnerability exists in the grabimage function in YzmCMS version 5.5. No detailed vulnerability details are provided...

CVE-2021-27663

A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authorization. This issue affects: Johnson Controls CEM Systems AC2000 10.1; 10.2; 10.3; 10.4; 10.5...

alphapulldown (>=0.21.2 <=0.22.3), analytics-lib (>=0.0.1 <=0.0.2) +52 more potentially affected by CVE-2021-37675 via tensorflow (=2.5.0)

tensorflow PYPI version =2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - alphapulldown =0.21.2, =0.0.1, =1.1.0, =0.8.1, =3.3.0, =0.0.24, =1.0.0, =2.0.2, =0.6.0, =0.7.0, =1.4.0 - fancyimpute =0.6.0 and more Source...

CVE-2021-28625

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

VulnCheck KEV: CVE-2014-0640

EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors...

PT-2021-10810 · Empirecms · Empirecms

Name of the Vulnerable Software and Affected Versions: EmpireCMS version 7.5 Description: A remote code execution issue in the e/install/index.php file allows attackers to execute arbitrary PHP code by writing malicious code to the install file. This enables attackers to potentially gain control...

CVE-2021-36787

The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document...

CVE-2021-37172

A vulnerability has been identified in SIMATIC S7-1200 CPU family incl. SIPLUS variants V4.5.0. Affected devices fail to authenticate against configured passwords when provisioned using TIA Portal V13. This could allow an attacker using TIA Portal V13 or later versions to bypass authentication an...

CVE-2021-32002

Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configuration of the SiteManager. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware...

3S-Smart Software Solutions CODESYS Control runtime system 缓冲区错误漏洞

3S-Smart Software Solutions CODESYS Control runtime system is an application system from 3S-Smart Software Solutions, Germany. It is used for the conversion of any type of smart device to an IEC 61131-3 controller. A security vulnerability exists in 3S-Smart Software Solutions CODESYS Control...

PT-2021-21735 · Meow Hash · Meow Hash

Name of the Vulnerable Software and Affected Versions: Meow hash version 0.5/calico Description: The issue concerns a weakness in Meow hash 0.5/calico that allows an attacker to recover keys by querying whether there's a collision in the bottom bits of the hashes of two messages. This is...

Apple iPadOS 缓冲区错误漏洞

Apple iPadOS is a set of operating systems from Apple Inc. for the iPad tablet computer. A buffer error vulnerability exists in Apple iPadOS that could allow an application to execute arbitrary code with kernel privileges. The affected products and versions are as follows:Apple iPadOS 11.5.1, iOS...

CVE-2021-2423

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Filters. The supported version that is affected is 8.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In...