Input validation

grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames...

CVE-2021-3799 Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin

grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames...

PT-2021-21388 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: WordPress uListing plugin versions = 2.0.5 Description: The issue is related to an Authenticated Reflected Cross-Site Scripting XSS vulnerability. Vulnerable parameters include filterid, filteruser, filterexpired date, filtercreated date, and...

Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby

Severity The Nokogiri maintainers have evaluated this as High Severity 7.5 CVSS3.0 for JRuby users. This security advisory does not apply to CRuby users. Impact In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who par...

CVE-2021-28130

Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload within a legitimate binary e.g., frwlsvc.exe bypasses firewall filters...

CVE-2021-28130

Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload within a legitimate binary e.g., frwlsvc.exe bypasses firewall filters...

CVE-2021-36749

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

Privilege escalation

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

ManageEngine Log360 < Build 5229 REST API Restriction Bypass RCE

Binary data manageenginelog360cve-2021-40539.nbin...

Samba >= 3.2.0 Bypass File Restriction Vulnerability (CVE-2013-4475)

ACLs are not checked on opening an alternate data stream on a file or directory. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

Samba 4.0.0 Bypass Restriction Vulnerability (CVE-2013-0172)

Samba 4.0.0 as an AD DC may provide authenticated users with write access to LDAP directory objects. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

PT-2021-16156 · Oracle · Linux-Oracle

Name of the Vulnerable Software and Affected Versions: Oracle Linux versions 7 through 8 Description: A vulnerability in the OSwatcher component of Oracle Linux allows a low-privileged attacker with logon to the infrastructure to compromise Oracle Linux. Successful attacks can result in the...

PT-2021-22998 · Gurock · Gurock Testrail

Name of the Vulnerable Software and Affected Versions: Gurock TestRail versions prior to 7.2.0.3014 Description: The issue is related to improper access control, resulting in sensitive information exposure. A threat actor can access the "/files.md5" file on the client side of a Gurock TestRail...

Google Chrome UI security bypass vulnerability

Chrome is a simple and efficient web browsing tool developed by Google, which is characterized by simplicity and speed. Google Chrome suffers from a security vulnerability. An attacker could exploit this vulnerability to bypass security restrictions...

CLSA-2021-1632261664 Fix of CVE: CVE-2021-27364, CVE-2021-27363, CVE-2021-27365

CVE-2021-27365: scsi: iscsi: Ensure sysfs attributes are limited to PAGESIZE - CVE-2021-27365: scsi: iscsi: Verify lengths on passthrough PDUs - CVE-2021-27363: CVE-2021-27364: scsi: iscsi: Restrict sessions and handles to admin capabilities - sysfs: Add sysfsemit and sysfsemitat to format sysfs...

GHSA-JP7F-GRCV-6MJF Partial path traversal in sharpcompress

SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in options. In order to prevent extraction outside the destination directory the destinationFileName path is verified to begin with fullDestinationDirectoryPath. However it is not...

PT-2021-16099 · WordPress · Timetable/Event Schedule

Name of the Vulnerable Software and Affected Versions: Timetable and Event Schedule WordPress plugin versions prior to 2.4.2 Description: The issue concerns a lack of proper access control and the absence of a CSRF check, allowing any user with the edit posts capability to delete arbitrary...

The vulnerability of the function in bl_categires_help.php, a parental control function for Internet CTparental, allows a intruder to inject any code they desire.

The vulnerability of the CTparental parental control function in blcategireshelp.php exists due to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a hacker to inject arbitrary code...

PT-2021-19547 · Mcafee · Mcafee Data Loss Prevention (Dlp) Discover

Name of the Vulnerable Software and Affected Versions: McAfee Data Loss Prevention DLP Discover versions prior to 11.6.100 Description: A buffer overflow issue allows an attacker in the same network as the DLP Discover to execute arbitrary code through placing carefully constructed Ami Pro .sam...

Flickr: Flickr Account Takeover using AWS Cognito API

Flickr uses Amazon Cognito to implement its login functionality. Furthermore, Flickr does not allow users to change their registered e-mail address via the user interface. This restriction can be bypassed via direct communication with the Amazon Cognito User Pool API. Consider we have the followi...