1615 matches found
CVE-2021-28680: Undefined Security Weakness
The devisemasquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise without this extension is used. If the...
CVE-2021-43404: Undefined Security Weakness
An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters...
CVE-2021-43405: Undefined Security Weakness
An issue was discovered in FusionPBX before 4.5.30. The faxextension may have risky characters it is not constrained to be numeric...
Bug in Popular WinRAR Software Could Let Attackers Hack Your Computer
A new security weakness has been disclosed in the WinRAR trialware file archiver utility for Windows that could be abused by a remote attacker to execute arbitrary code on targeted systems, underscoring how vulnerabilities in such software could beсome a gateway for a roster of attacks. Tracked a...
CVE-2021-35601: Undefined Security Weakness
Vulnerability in the PeopleSoft Enterprise CS SA Integration Pack product of Oracle PeopleSoft component: Students Administration. Supported versions that are affected are 9.0 and 9.2. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segmen...
CVE-2021-35609: Undefined Security Weakness
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: SQR. Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...
CVE-2021-42575: Undefined Security Weakness
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
CVE-2021-41361: Undefined Security Weakness
Active Directory Federation Server Spoofing Vulnerability...
GitHub Revoked Insecure SSH Keys Generated by a Popular git Client
Code hosting platform GitHub has revoked weak SSH authentication keys that were generated via the GitKraken git GUI client due to a vulnerability in a third-party library that increased the likelihood of duplicated SSH keys. As an added precautionary measure, the Microsoft-owned company also said...
CVE-2021-25470
An improper caller check logic of SMC call in TEEGRIS secure OS prior to SMR Oct-2021 Release 1 can be used to compromise TEE...
CVE-2021-39874: Undefined Security Weakness
In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands...
Apple AirTag Bug Enables ‘Good Samaritan’ Attack
The new $30 AirTag tracking device from Apple has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owners phone number if the AirTag has been set to lost mode. But according to new research, this same feature can be abused t...
CVE-2021-36366: Undefined Security Weakness
Nagios XI before 5.8.5 incorrectly allows manageservices.sh wildcards...
CVE-2021-40329: Undefined Security Weakness
The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management...
CVE-2021-23243: Undefined Security Weakness
In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used...
CVE-2021-41558: Undefined Security Weakness
The setuser extension module before 3.0.0 for PostgreSQL allows ProcessUtilityhook bypass via setconfig...
Security Weakness Resulting in Potential Local Privilege Escalation When HA (High Availability) is Active
A weakness in the SMA100 Series exists when High Availability HA pair is active, potentially permitting an operation at a privilege's level that is higher than the minimum level required. If a malicious actor obtains a 'nobody' user shell on an impacted SMA100 device, this can potentially lead to...
High-Severity RCE Flaw Disclosed in Several Netgear Router Models
Networking equipment company Netgear has released patches to remediate a high-severity remote code execution vulnerability affecting multiple routers that could be exploited by remote attackers to take control of an affected system. Traced as CVE-2021-40847 CVSS score: 8.1, the security weakness...
golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet
A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...