837 matches found
Authentication flaw
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2,...
CVE-2021-22565
CVE-2021-22565 affects the Google Exposure Notifications Verification Server. Root cause: insufficient granularity of access control in the verification-server component, enabling an attacker with permission to expire verification codes to invalidate codes that belong to another realm if the UUID...
GHSA-8GW6-W5RW-4G5C Incorrect Default Permissions in Apache JSPWiki
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later...
CVE-2021-44140
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later...
Exploit for Code Injection in Gitlab
CVE-2021-22205-getshell CVE-2021-22205-getshell Test v...
CVE-2021-22557
SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173...
USN-5079-3 curl vulnerabilities
USN-5079-1 fixed vulnerabilities in curl. One of the fixes introduced a regression on Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that curl incorrect handled memory when sending data to an MQTT server. A remote...
CVE-2021-39180 Path Traversal in Archive Handling Leading to Code Execution
OpenOLAT is a web-based learning management system LMS. A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user e.g. the tomcat user. Depending...
CVE-2021-2307 affecting package mysql 8.0.23-1
CVE-2021-2307 affecting package mysql 8.0.23-1. An upgraded version of the package is available that resolves this issue...
CVE-2019-12855 affecting package python-twisted 19.2.1-5
CVE-2019-12855 affecting package python-twisted 19.2.1-5. An upgraded version of the package is available that resolves this issue...
CVE-2018-19787 affecting package python-lxml 4.2.4-7
CVE-2018-19787 affecting package python-lxml 4.2.4-7. An upgraded version of the package is available that resolves this issue...
CVE-2020-27783 affecting package python-lxml 4.2.4-7
CVE-2020-27783 affecting package python-lxml 4.2.4-7. An upgraded version of the package is available that resolves this issue...
CVE-2021-29148
A local cross-site scripting XSS vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series versions: Aruba AOS-CX firmware: 10.04.xxxx ...
CVE-2021-31525 affecting package golang 1.15.11-1
CVE-2021-31525 affecting package golang 1.15.11-1. An upgraded version of the package is available that resolves this issue...
GHSA-6RG3-8H8X-5XFV Unchecked hostname resolution could allow access to local network resources by users outside the local network
Impact A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This...
Unchecked hostname resolution could allow access to local network resources by users outside the local network
Impact A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This...
CVE-2021-20197 affecting package binutils 2.32-5
CVE-2021-20197 affecting package binutils 2.32-5. An upgraded version of the package is available that resolves this issue...
CVE-2021-29621
Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version...