Sylius 信息泄露漏洞

Sylius is a Polish company Sylius set of open source e-commerce platform based on the Symfony framework . A security vulnerability exists in Sylius versions prior to 1.9.5 and 1.10.0-RC, which stems from the fact that some of the details of an order placed in Sylius order ID, order number, total...

CVE-2018-10195

lrzsz before version 0.12.21rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a sizet to wrap around...

CVE-2018-10195

lrzsz before version 0.12.21rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a sizet to wrap around...

CVE-2018-10195

lrzsz before version 0.12.21rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a sizet to wrap around...

CVE-2018-10195

lrzsz before version 0.12.21rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a sizet to wrap around...

CVE-2020-21843

A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bitreadRC ../../src/bits.c:318...

CVE-2021-3483

A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest threat from this vulnerability is to confidentiality, integrity, as well as system...

PT-2021-10688

Name of the Vulnerable Software and Affected Versions: GNU LibreDWG version 0.10 Description: A heap-based buffer overflow issue exists in GNU LibreDWG. The problem is related to the bit read RC function in the bits.c file. Recommendations: For GNU LibreDWG version 0.10, consider restricting acce...

CVE-2021-27253

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handli...

AZL-6540 CVE-2021-28952 affecting package kernel for versions less than 5.10.78.1-1

An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. This has been fixed in 5.12-rc4...

[SECURITY] Fedora 34 Update: tali-40~rc-1.fc34

Sort of poker with dice and less money. An ancient Roman game...

Grav 路径遍历漏洞

Grav is a flat file CMS that uses Markdown files for content management. A path traversal vulnerability exists in the backup feature of Grav 1.7.0-rc.17 and earlier versions. An attacker can exploit this vulnerability to read arbitrary local files on the underlying server...

CVE-2021-21379

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the wikimacrocontent executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inje...

CVE-2021-21379

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the wikimacrocontent executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inje...

Path Traversal in rust-compress/rc-zip

:book: Description rc-zip Pure rust zip & zip64 reading and writing. this package is vulnerable for zip-slip https://github.com/rust-compress/rc-zip https://crates.io/crates/rc-zip :recycle: Steps To Reproduce-: 0 download and run latest release from https://github.com/rust-compress/rc-zip 1 run ...

Amazon Aws-sdk-js Security Vulnerability

Amazon Aws-sdk-js is a Javascript-based development kit for AWS service support for nodejs applications from Amazon.com, Inc. A security vulnerability exists in Amazon Aws-sdk-js before 1.0.0-rc.9, which can be exploited by an attacker to submit a malicious INI file to an application for further...

CVE-2020-29587

SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input, which results in a DOM XSS, because it uses the jQuery .html function to directly...

Design/Logic Flaw

SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input, which results in a DOM XSS, because it uses the jQuery .html function to directly...

Simplcommerce 跨站脚本漏洞

Simplcommerce is Simplcommerce individual developers of a .Net-based e-commerce platform. SimplCommerce 1.0.0-rc suffers from a cross-site scripting vulnerability in which the Bootbox.js library does not perform any cleanup operations on user input. No details of the vulnerability are provided at...

UBUNTU-CVE-2021-20177

A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user with root or CAPNETADMIN when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected...