CVE-2021-43557

The uri-block plugin in Apache APISIX before 2.10.2 uses $requesturi without verification. The $requesturi is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains...

CVE-2021-39234

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL...

CVE-2021-39234

CVE-2021-39234 affects Apache Ozone up to version 1.2.0. The vulnerability allows an authenticated user who knows the ID of an existing block to craft a request that accesses that block, bypassing ACL and other security checks. This is a block-access control error in the Ozone identity/authorizat...

Security feature bypass

Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal databas...

KLA12353 Multiple vulnerabilities in Opera

Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Policy enforcement vulnerability in Autofill can be exploited to bypass...

Google Chrome 权限许可和访问控制问题漏洞

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome iframe sandbox that stems from improper policy enforcement in the product's iframe sandbox. An attacker can exploit the vulnerability to bypass security restrictions...

AMD Graphics Driver 输入验证错误漏洞

AMD Graphics Driver is an integrated graphics driver from AMD. An input validation error vulnerability exists in AMD Graphics Driver, which can be exploited by attackers to bypass security restrictions and enable arbitrary code execution...

Hackers Exploit macOS Zero-Day to Hack Hong Kong Users with new Implant

Google researchers on Thursday disclosed that it found a watering hole attack in late August exploiting a now-patched zero-day in macOS operating system and targeting Hong Kong websites related to a media outlet and a prominent pro-democracy labor and political group to deliver a never-before-see...

The vulnerability of the File Transfer Protocol (FTP) implementation and the NAT functions of the Application Layer Gateway (ALG) in microprogrammable network devices such as Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to circumvent security restrictions and establish unauthorized connections.

The vulnerability of the File Transfer Protocol FTP implementation and the Network Address Translation NAT function of the Application Layer Gateway ALG in microprogrammable network devices such as Cisco Adaptive Security Appliances ASA and Cisco Firepower Threat Defense FTD is related to...

Mozilla Firefox Security Advisory (MFSA2012-70) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

haproxy: does not ensure that the scheme and path portions of a URI have the expected characters

A flaw was found in haproxy. An input validation flaw when processing HTTP/2 requests causes haproxy to not ensure that the scheme and path portions of a URI have the expected characters. This may cause specially crafted input to bypass implemented security restrictions. The highest threat from...

CVE-2021-42288

Windows Hello Security Feature Bypass Vulnerability...

CVE-2021-42288

Windows Hello Security Feature Bypass Vulnerability...

KLA12357 Multiple vulnerabilities in Apple iCloud

Multiple vulnerabilities were found in Apple iCloud. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A code execution vulnerability in ImageIO can be exploited via special crafted image to...

PT-2021-4795 · Microsoft · Windows Fast Fat File System Driver +1

Name of the Vulnerable Software and Affected Versions: Windows Fast FAT File System Driver affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Fast FAT File System Driver, which can be exploited to bypass security restrictions and...

KLA12337 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A security feature bypass vulnerability in Microsoft Excel can be exploited remotely ...

SAP NetWeaver Application Server 权限许可和访问控制问题漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A privilege permission and access control issue vulnerability exists in SAP NetWeaver Application Server, which arises from an application that does not properly impose security restrictions. The vulnerability can be...

Microsoft Excel Security Feature Bypass (CVE-2021-42292)

A security bypass vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability would allow remote attackers to bypass security tests and protocols on the affected system...

Vulnerabilities fixed in Mirosoft Windows

Microsoft has fixed vulnerabilities in Windows. The vulnerabilities potentially enable a malicious person to launch attacks execute attacks that result in the following categories of damage: Increased user privileges. Remote code execution User Rights Denial-of-Service DoS. Circumvention of...

Jetbrains JetBrains TeamCity 访问控制错误漏洞

JetBrains TeamCity is a distributed build management and continuous integration tool from Czech company JetBrains Jetbrains. The tool provides continuous unit testing, code quality analysis, and build issue analysis reports.JetBrains TeamCity has an access control error vulnerability that stems...