Statamic 加密问题漏洞

Statamic is a powerful flat file Cms built on Laravel by Statamic, Inc. for storing all content, templates, assets, and settings in a file instead of a database. Statamic suffers from a security vulnerability that stems from the fact that prior to versions 3.2.39 and 3.3.2, it was possible to...

Microweber 跨站脚本漏洞

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.2.11. The vulnerability stems from a lack...

TP-LINK AC1750 缓冲区错误漏洞

The TP-LINK AC1750 is a wireless router from China P&L TP-LINK. A buffer error vulnerability exists in the TP-LINK AC1750 prior to version 211210, which stems from a lack of proper validation of user-supplied data, which could result in reading beyond the end of an allocated buffer. An attacker...

Facebook Hermes 安全漏洞

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native apps to improve the performance of mobile client apps, but not server-side infrastructures such as browsers & Node.js. A security vulnerability exists in Facebook Hermes, which...

CVE-2021-45517

NETGEAR XR1000 devices before 1.0.0.58 are affected by denial of service...

CVE-2021-42683

A Buffer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200. The IOCTL Handler 0x22001B allows local attackers to execute arbitrary code in kernel mode or cause a denial of service memory corruption and OS crash via specially crafted I/O Request Packet...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin MotoPress, which stems from the fact that...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the WordPress plugin WordPress Advanced Ticket System, Elite Support...

PT-2021-7369 · Unknown · Go-Ethereum

Name of the Vulnerable Software and Affected Versions: go-ethereum versions prior to v1.10.8 Description: A consensus-vulnerability in go-ethereum Geth could cause a chain split, where vulnerable versions refuse to accept the canonical chain. This issue is related to a memory-corruption bug withi...

snakeyaml: Billion laughs attack via alias feature

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

GHSA-Q5R4-CFPX-H6FH Improper Handling of Length Parameter Inconsistency in Apache Ant

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected...

Swisslog Healthcare Nexus Panel 数字错误漏洞

Swisslog Healthcare Nexus Panel, a medical device from Swisslog Healthcare, is vulnerable to an integer underflow vulnerability in versions prior to Nexus Control Panel 7.2.5.7. An attacker could use this vulnerability to override the internal queue data structure, which could enable remote code...

CVE-2021-20102

Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place...

SICK Visionary-S CX 加密问题漏洞

SICK Visionary-S CX is a 3D vision sensor from SICK, Germany. It provides direct output of color and depth values via Ethernet. The SICK Visionary-S CX has a security vulnerability in versions prior to 5.21.2.29154R, which can be exploited by an attacker with a weak password to more easily...

CVE-2021-3569

A stack corruption bug was found in libtpms in versions before 0.7.2 and before 0.8.0 while decrypting data using RSA. This flaw could result in a SIGBUS bad memory access and termination of swtpm. The highest threat from this vulnerability is to system availability...

IMAGE CONQUEST DICOM SERVER 命令注入漏洞

IMAGE CONQUEST DICOM SERVER is IMAGE an open source application. It can store, validate, query and retrieve through programmable SQL database tables. A security vulnerability exists in CONQUEST DICOM SERVER before 1.5.0, which can be exploited by attackers to execute malicious code...

CVE-2021-24144

Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files...

CVE-2020-24448

Uncaught exception in some IntelR Graphics Drivers before version 15.33.51.5146 may allow an authenticated user to potentially enable denial of service via local access...

HPE Apollo 70 命令命令注入漏洞

The HPE Apollo 70 system is an Arm-based platform that provides the density and scalability required for large HPC cluster deployments. A command injection vulnerability exists in the libifc.so uploadsshkey function in the Baseboard Management Controller BMC firmware in HPE Apollo 70 versions pri...

PT-2020-18894 · Google +1 · Libprotobuf +1

Name of the Vulnerable Software and Affected Versions: Valve's Game Networking Sockets versions prior to v1.2.0 Description: The issue arises from improper handling of inlined statistics messages in the CConnectionTransportUDPBase::Received Data function, leading to an exception thrown from...