CVE-2021-44466

Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN...

Bitmask 权限许可和访问控制问题漏洞

Bitmask is an open source application that provides simple and secure encrypted communication via VPN.An access control error vulnerability exists in Bitmask Riseup VPN, which stems from a failure to properly handle ACLs when the product is installed in a non-default directory.An attacker could...

CVE-2021-21912

A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger...

CVE-2021-21912

A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger...

CVE-2021-44857

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page that the user doesn't have edit rights for. This applies to any public wiki, or a...

DEBIAN-CVE-2021-44857

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page that the user doesn't have edit rights for. This applies to any public wiki, or a...

CVE-2021-44857

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page that the user doesn't have edit rights for. This applies to any public wiki, or a...

UBUNTU-CVE-2021-44857

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page that the user doesn't have edit rights for. This applies to any public wiki, or a...

CVE-2021-44857

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page that the user doesn't have edit rights for. This applies to any public wiki, or a...

CVE-2021-44857

CVE-2021-44857 affects MediaWiki up to: 1.35.4? (note: listed as 1.35.5, 1.36.x before 1.36.3, 1.37.x before 1.37.1). The issue allows an attacker to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page, even if the user lacks edit rights on that page, app...

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats stems from deficiencies in the deserialization mechanism. This allows attackers to gain access to protected information and replace objects on the server side.

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow an attacker to gain access to protected information and replace objects on the server side by...

Description of the security update for Office Web Apps Server 2013: December 14, 2021 (KB5002103)

None None...

Description of the security update for Excel 2013: December 14, 2021 (KB5002105)

Description of the security update for Excel 2013: December 14, 2021 KB5002105 Summary This security update resolves a Microsoft Excel remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2021-43256. Note: To apply this...

The vulnerability of Microsoft SharePoint Server packages, related to the lack of integrity checks, allows attackers to gain unauthorized access to protected information.

The vulnerability of Microsoft SharePoint Server packages is related to the lack of integrity checks. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by replacing the content of files during the download of updates...

Privilege Escalation

jenkins is vulnerable to privilege escalation. The vulnerability exists due to a lack of limiting the agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library wit...

The vulnerability of the Mozilla Firefox browser, related to insufficient warnings about dangerous actions, allows a hacker to carry out an attack using a spearphishing technique.

The vulnerability of the Mozilla Firefox browser is related to insufficient warnings about dangerous actions. Exploiting this vulnerability allows a remote attacker to carry out an attack using a spearphishing technique by replacing the user’s browser interface...

PT-2021-23926 · Google · Google Login

Name of the Vulnerable Software and Affected Versions: Redash versions 10.0 and prior Description: The implementation of Google Login in Redash incorrectly uses the state parameter to pass the next URL to redirect the user to after login, instead of using it for a Cross-Site Request Forgery CSRF...

ISC BIND DoS Vulnerability (CVE-2011-1907)

ISC BIND is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

GSD-2021-1002081 btrfs: fix abort logic in btrfs_replace_file_extents

btrfs: fix abort logic in btrfsreplacefileextents This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.14 by commit...

CVE-2021-43578

Jenkins Squash TM Publisher Squash4Jenkins Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an...