PT-2021-22451 · Capture · Capture

Name of the Vulnerable Software and Affected Versions: pcapture versions prior to 3.12 Description: The issue allows an authenticated but unprivileged user to use the REST API to capture and download packets with no capture filter and without adequate permissions. This is significant because...

Misskey 跨站脚本漏洞

Misskey is a micro-blogging platform. A cross-site scripting vulnerability exists in versions of Misskey prior to 12.51.0, which stems from a built-in dialog box in the Web client that does not validate and escape user input. An attacker could display a malicious string in the dialog box and use ...

DOPSoft Stack Buffer Overflow Vulnerability

DOPSoft is a Human Machine Interface HMI programming software from Delta Electronics. A stack buffer overflow vulnerability exists in DOPSoft 4.00.11 and earlier versions. The vulnerability can be exploited by an attacker to execute arbitrary code via a specially crafted project file...

GHSA-VJ88-5667-W56P Singleton lacks bounds on Send and Sync.

Singleton is meant to be a static object that can be initialized lazily. In order to satisfy the requirement that static items must implement Sync, Singleton implemented both Sync and Send unconditionally. This allows for a bug where non-Sync types such as Cell can be used in singletons and cause...

GHSA-M57C-4VVX-GJGQ Format string vulnerabilities in pancurses

An issue was discovered in the pancurses crate through 0.16.1 for Rust. printw and mvprintw have format string vulnerabilities...

CVE-2021-1580

Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller APIC or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see t...

CVE-2021-1581

Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller APIC or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see t...

VMware vRealize Operations 路径遍历漏洞

vmware VMware vRealize Operations is an application from vmware, Inc. A unified, AI-based platform for private, hybrid, and multi-cloud environments that delivers IT operations management on autopilot. A path traversal vulnerability exists in Vmware vRealize Operations Manager that stems from the...

VMware vRealize Operations 日志信息泄露漏洞

vmware VMware vRealize Operations is an application from vmware, Inc. A unified, AI-based platform for private, hybrid, and multi-cloud environments that delivers IT operations management on autopilot. A log information disclosure vulnerability exists in Vmware vRealize Operations Manager that...

PT-2021-4957 · Cisco · Cisco Apic +1

Name of the Vulnerable Software and Affected Versions: Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Application Policy Infrastructure Controller Cloud APIC affected versions not specified Description: A vulnerability in the API endpoint of the affected systems could all...

Cisco Application Policy Infrastructure Controller 命令注入漏洞

Cisco Application Policy Infrastructure Controller APIC is an automated infrastructure deployment and governance solution from Cisco. A command injection vulnerability exists in Cisco Application Policy Infrastructure Controller, which stems from the product's web UI and API endpoint not validati...

PackageDNA - Tool To Analyze Software Packages Of Different Programming Languages That Are Being Or Will Be Used In Their Codes

This tool gives developers, researchers and companies the ability to analyze software packages of different programming languages that are being or will be used in their codes, providing information that allows them to know in advance if this library complies with processes. secure development, i...

CVE-2021-38453

Some API functions allow interaction with the registry, which includes reading values as well as data modification...

CVE-2021-38477

There are multiple API function codes that permit reading and writing data to or from files and directories, which could lead to the manipulation and/or the deletion of files...

CVE-2021-38463

The affected product does not properly control the allocation of resources. A user may be able to allocate unlimited memory buffers using API functions...

CVE-2021-32829

ZStack is open source IaaSinfrastructure as a service software aiming to automate datacenters, managing resources of compute, storage, and networking all by APIs. Affected versions of ZStack REST API are vulnerable to post-authentication Remote Code Execution RCE via bypass of the Groovy shell...

Broken Object Level Authorization☝️ — What you need to know

Broken Object Level Authorization☝️ — What you need to know What is Broken Object Level Authorisation? Broken Object Level Authorisation all starts with an object. Objects should be looked at in the context of “Object Oriented Programming”, what I mean with that is objects are the things you think...

golang: archive/zip: malformed archive may cause panic or memory exhaustion

A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files...

RLSA-2021:3074 Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 14.17.3. BZ1978203 Security Fixes: nodejs-hosted-git-info: Regular Expression denial...

perl bug fix and enhancement update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Bug Fixes and Enhancements: perl-net-ping wrong return value on failing DNS name lookup BZ1973176...