Exploit for Path Traversal in Apache Http_Server

CVE...

jasmincare.eu Improper Access Control vulnerability OBB-2263360

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-J6WP-3859-VXFG OIDC claims not updated from Identity Provider in Pomerium

Impact Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowedidpclaims as part of policy. If using allowedidpclaims and a user's claims are changed, Pomerium can make incorrect authorization decisions. Patches v0.15.6 Workarounds - Clear...

OSV-2021-1559 Heap-buffer-overflow in ih264d_mark_err_slice_skip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40851 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ih264dmarkerrsliceskip ih264dvideodecode ih264dapifunction...

InvestorDistribution uses setAdmin anti-pattern

Handle elprofesor Vulnerability details Impact InvestorDistriubtion.sol uses a setAdmin function which directly sets privileged user accounts to a set value. If this function is used incorrectly or by accident, the admin user may be lost or set to a malicious account. Recommended Mitigation Steps...

news.abidjan.net Cross Site Scripting vulnerability OBB-2253330

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

python-cryptography bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

ALBA-2021:4431 lvm2 bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

ModemManager bug fix and enhancement update

An update is available for ModemManager. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

openscap bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

ASB-A-172251622

In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to improper input validation. This could lead to remote escalation of privilege, confusing the user into accepting pairing of a malicious Bluetoo...

Exploit for Code Injection in Gitlab

GitLab-preauth-RCECVE-2021-22205 single line bash PoC for Gi...

Google Chrome under-validation vulnerability for untrusted inputs

Chrome, a simple and efficient web browsing tool developed by Google, is vulnerable to insufficient validation of untrusted input in Intents in versions prior to Google Chrome 95.0.4638.69. A remote attacker could exploit this vulnerability to arbitrarily browse malicious URLs via crafted HTML...

GSD-2021-1001853 mlxsw: thermal: Fix out-of-bounds memory accesses

mlxsw: thermal: Fix out-of-bounds memory accesses This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.75 by commit...

GSD-2021-1001811 xhci: Fix command ring pointer corruption while aborting a command

xhci: Fix command ring pointer corruption while aborting a command This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.213 by commit...

Panther Labs: Broken subdomain takeover of runpanther which was pointing towards herokuapp

An outdated link on our public blog pointed to a decommissioned Slack sign-up app hosted on Heroku for our also-decommissioned open source Slack community. The reporter was able to re-register the decommissioned subdomain with his own Heroku account...

CVE-2021-31682

creationtimestamp| type| source ---|---|--- 2021-10-22 16:39:20+00:00| seen| https://t.me/cibsecurity/31022 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-31682.yaml...

Cross-site Scripting (XSS) - Stored in archerysec/archerysec

Description The application is vulnerable to a Stored XSS attack. It is possible for an authenticated user to inject a JavaScript payload that will be executed in the web browser of the users viewing the concerned pages. When uploading a Burp scan, the XML field "issueBackground" of a vulnerabili...

Buffer overflow

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Filters. The supported version that is affected is 8.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In...

UVI-2021-1001637 HID: usbhid: free raw_report buffers in usbhid_stop

HID: usbhid: free rawreport buffers in usbhidstop This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.71 by commit...