JetBrains Hub 授权问题漏洞

JetBrains Hub is a server that can handle authentication, authorization, users, groups, permissions, and projects across multiple JetBrains Team Tools installations. An authentication restriction mechanism bypass vulnerability exists in JetBrains Hub versions prior to 2021.1.13690. An attacker ca...

PT-2021-7326 · Mariadb +6 · Mariadb +7

Name of the Vulnerable Software and Affected Versions: MariaDB versions prior to 10.6.5 Description: The issue is related to an integer overflow in the sql lex.cc component of MariaDB, which can lead to an application crash. This can be exploited by an attacker to cause a denial of service...

CVE-2021-3924

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

Grav 路径遍历漏洞

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product presentations. A path traversal vulnerability exists in grav, which stems from an improper restriction of pathnames to restricted directories in the affected product...

CVE-2021-21698

An incorrect access restriction vulnerability was found in the Subversion Plugin for Jenkins. An agent's ability to learn the name of a file is not restricted when looking up a subversion key file on the controller. This may allow attackers to control agent processes and read arbitrary files on t...

CVE-2021-21698

Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent...

CVE-2021-21697

An incorrect access restriction vulnerability was found in Jenkins. The directories agents are allowed to access include the directories where there are stored build-related information intended to allow agents to store build-related metadata during build execution. As a consequence, this allows ...

CVE-2021-21688

An incorrect access restriction vulnerability was found in Jenkins. The FilePathreadingFileVisitor does not reject any operations giving users unrestricted read access with certain operations creating archives, copyRecursiveTo. This may allow an attacker to get access to restricted data. Mitigati...

CVE-2021-21698

CVE-2021-21698 affects Jenkins Subversion Plugin up to version 2.15.0. The issue arises because the plugin does not restrict the file name when resolving the subversion key file on the controller from an agent, enabling path traversal to read arbitrary files on the Jenkins controller when an atta...

CVE-2021-21698

Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent...

Huawei HarmonyOS restriction vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. Huawei HarmonyOS 2.0 previously had a security vulnerability that could be exploited by an attacker to cause nearby processes to crash...

PT-2021-23752 · Unknown · Sourcecodester Simple Subscription Website

Name of the Vulnerable Software and Affected Versions: Sourcecodester Simple Subscription Website version 1.0 Description: A Cross Site Scripting XSS issue exists due to the id parameter in plan application. This allows for potential malicious script execution. Recommendations: For version 1.0,...

Improper Authorization in Publify

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. guest role users can self-register even when the admin does not allow. This happens due to front-end restriction only...

Access Restriction Bypass

Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Access Restriction Bypass due to front-end restrictions. Random users can self-register even when the admin does not allow it. Remediation Upgrade...

CVE-2021-25973

Affected software: Publify (versions 9.0.0.pre1–9.2.4). Vulnerability type: Improper Access Control allowing a guest user to self-register even when the admin disallows it, resulting from front-end restriction rather than server-side controls. Impact (as described): Guest users can create account...

CVE-2021-25973 Publify - Improper Authorization Leads to Guest Signup Restriction Bypass

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only...

CVE-2021-25973 Publify - Improper Authorization Leads to Guest Signup Restriction Bypass

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only...

The vulnerability of the Tar.php file in the Archive_Tar package of the PHP PEAR library arises from an improper restriction on the path name of the directory. This allows a attacker to compromise data integrity.

The vulnerability of the Tar.php file in the ArchiveTar package from the PHP PEAR library is related to improper handling of symbolic links. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...

KLA12335 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to obtain sensitive information, spoof user interface, bypass security restrictions, execute arbitrary code, cause denial of service, perform cross-site scripting attack. Below is a complete...

PT-2021-8017 · Mozilla +2 · Firefox +2

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 94 Description: The issue is related to incorrect restriction of visualized layers in the user interface, which can be exploited by a remote attacker to conduct spoofing attacks. When parsing internationalize...