Design/Logic Flaw

x86: Speculative vulnerabilities with bare non-shim 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to...

UBUNTU-CVE-2021-28689

x86: Speculative vulnerabilities with bare non-shim 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to...

LANCOM R&S Unified Firewalls 路径遍历漏洞

LANCOM R&S Unified Firewalls is a customized, complete solution that provides state-of-the-art security and Unified Threat Management UTM for small and medium-sized businesses. A path traversal vulnerability exists in LCOS FX for LANCOM R&S Unified Firewalls, which stems from LCOS FX 10.5 failing...

CVE-2021-27637

Under certain conditions SAP Enable Now SAP Workforce Performance Builder - Manager, versions - 1.0, 10 allows an attacker to access information which would otherwise be restricted leading to information disclosure...

CVE-2021-27637

Under certain conditions SAP Enable Now SAP Workforce Performance Builder - Manager, versions - 1.0, 10 allows an attacker to access information which would otherwise be restricted leading to information disclosure...

Information disclosure

Information Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server for Java, versions - 7.11,7.20,7.30,7.31,7.40 and 7.50 allows attackers to access restricted information by entering malicious server name...

hw: improper isolation of shared resources in some Intel Processors

Microcode misconfiguration in some Intel processors may cause EIBRS mitigation CVE-2017-5715 to be incomplete. As a consequence, this issue may allow an authenticated user to potentially enable information disclosure via local access...

PT-2021-17556

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for Java versions 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 Description The issue allows attackers to access restricted information by entering a malicious server name in the UserAdmin application. Recommendations...

The vulnerability of the Trend Micro OfficeScan antivirus protection lies in the improper restriction of the path to the restricted access catalog, allowing attackers to execute arbitrary code.

The vulnerability of the Trend Micro OfficeScan antivirus protection relates to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created zip file...

PT-2021-6264 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 11.2.1 and earlier Description: The issue is related to improper access control in Adobe Connect, which can lead to the elevation of privileges. An attacker with Learner permissions can exploit this to access the list o...

Schneider Electric IGSS

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: IGSS Interactive Graphical SCADA System Vulnerabilities: Out-of-bounds Write, Out-of-bounds Read, Access of Uninitialized Pointer, Use After Free, Release of Invalid Pointer or Reference,...

Mail.ru: Unauthorized Access To Admin panel

Access to static files of playerone.ru admin web interface was not sufficiently restricted. There was no possibility to access admin functions. Simple Bypass: Try access playerone.ru/admin/users/ 403 : host playerone.ru 127.0.0.1 Try again 127.0.0.1/admin/users 200 OK :...

Nextcloud 资源管理错误漏洞

An access control error vulnerability exists in Nextcloud End-to-End Encryption, an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany, which stems from improper access restrictions. The vulnerability allows remote attackers to gain...

CVE-2021-32662: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In @backstage/techdocs-common versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is buil...

CVE-2020-14388

A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows an authenticated user to bypass normal account restrictions and access API services where they do not have permission...

CVE-2020-14336

A flaw was found in the Restricted Security Context Constraints SCC, where it allows pods to craft custom network packets. This flaw allows an attacker to cause a denial of service attack on an OpenShift Container Platform cluster if they can deploy pods. The highest threat from this vulnerabilit...

Design/Logic Flaw

A flaw was found in the Restricted Security Context Constraints SCC, where it allows pods to craft custom network packets. This flaw allows an attacker to cause a denial of service attack on an OpenShift Container Platform cluster if they can deploy pods. The highest threat from this vulnerabilit...

PT-2021-9718 · Red Hat · Openshift Container Platform

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform affected versions not specified Description: A flaw in the Restricted Security Context Constraints SCC allows pods to craft custom network packets, enabling an attacker to cause a denial of service attack on a...

CVE-2020-14336: Allocation of Resources Without Limits or Throttling

A flaw was found in the Restricted Security Context Constraints SCC, where it allows pods to craft custom network packets. This flaw allows an attacker to cause a denial of service attack on an OpenShift Container Platform cluster if they can deploy pods. The highest threat from this vulnerabilit...

Synology DiskStation Manager Path Traversal Vulnerability (CNVD-2021-39156)

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A path traversal vulnerability exists in the PDF Viewer component of Synology...