Ubuntu 18.04 LTS / 20.04 LTS : Intel Microcode vulnerabilities (USN-4628-3)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4628-3 advisory. USN-4628-1 provided updated Intel Processor Microcode for various processor types. This update provides the corresponding updates for some...

File Upload Vulnerability in the Water Resources Project Management System of Siltronic Ltd.

SCT is an information service provider in China, dedicated to the cause of disaster mitigation and benefit reduction, and provides the government with comprehensive solutions for disaster mitigation and benefit reduction informatization. A file upload vulnerability exists in the water project...

CVE-2021-20993

In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory...

Vulnerability of the sub-component of the French HR component of the Oracle HRMS system, a business automation system from Oracle E-Business Suite. This component allows unauthorized access by attackers to devices.

The vulnerability of the sub-component of the French HR component of the Oracle HRMS system, a business automation system from Oracle’s E-Business Suite, is related to code errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device...

Denial Of Service (DoS)

hapi-fhir-jpaserver-api is vulnerable to denial of service. A weakness in the handling of FHIR history operations on a server with a very large number of resources would result in a denial of service condition if the history operation is executed by many clients e.g. 200 concurrently...

Adobe Magento 安全漏洞

Adobe Magento is the United States of America Odobie Adobe company's set of open source PHP e-commerce system . The system provides rights management, search engine and payment gateway and other functions. A security vulnerability exists in Adobe Magento. The vulnerability is due to incorrect...

Joint CISA-FBI Cybersecurity Advisory on DarkSide Ransomware

CISA and the Federal Bureau of Investigation FBI have released a Joint Cybersecurity Advisory CSA on a ransomware-as-a-service RaaS variant—referred to as DarkSide—recently used in a ransomware attack against a critical infrastructure CI company. Cybercriminal groups use DarkSide to gain access t...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

Hardcoded credentials

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

CVE-2021-23011

On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when the BIG-IP system is buffering packet fragments for reassembly, the Traffic Management Microkernel TMM may consume an excessive amount of...

Uncontrolled Resource Consumption

JPA Server in HAPI FHIR allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many...

Remote Code Execution (RCE)

com.vaadin, flow-server is vulnerable to remote code execution. An attacker is able to inject malicious code into the frontend resources during application rebuilds...

Emissary 安全漏洞

Emissary is a software application. A P2P-based data-driven workflow engine that runs across heterogeneous and potentially widely distributed multi-tier P2P network computing resources. An information disclosure vulnerability exists in Emissary version 5.9.0, which can be exploited by an attacker...

Hubs Cloud 配置错误漏洞

Hubs Cloud is an application for the Hubs community. All the AWS resources needed to host your own immersive space from your company or organization's own account can be created and managed. A misconfiguration vulnerability exists in Hubs Cloud that stems from a proxy feature built into the...

Flask-Cors Directory Traversal vulnerability

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

GHSA-XC3P-FF3M-F46V Flask-Cors Directory Traversal vulnerability

An issue was discovered in Flask-CORS aka CORS Middleware for Flask before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

CVE-2021-1530 Cisco BroadWorks Messaging Server XML External Entity Injection Vulnerability

A vulnerability in the web-based management interface of Cisco BroadWorks Messaging Server Software could allow an authenticated, remote attacker to access sensitive information or cause a partial denial of service DoS condition on an affected system. This vulnerability is due to improper handlin...

libxml2 资源管理错误漏洞

libxml2 is an open source library used to parse XML documents . It is written in C, and can be called by a variety of languages, such as C, C++, XSH. A resource management error vulnerability exists in entities.c in libxml2, which arises from mismanagement of system resources e.g., memory, disk...

Jellyfin 代码问题漏洞

Jellyfin is a freeware media system. It allows you to control the management and streaming of media. It is an alternative to the proprietary Emby and Plex and can serve media from a dedicated server to end-user devices through multiple applications. A code issue vulnerability exists in versions o...