CVE-2021-41233 Missing authorization in Nextcloud text

Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an...

CVE-2021-41233 Missing authorization in Nextcloud text

Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an...

PT-2022-11375 · Nextcloud +1 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 20.0.14 Nextcloud Server versions prior to 21.0.6 Nextcloud Server versions prior to 22.2.1 Description: The Nextcloud Text application, which is shipped with Nextcloud Server by default, has an issue that...

CVE-2022-24745 Guest session is shared between customers in shopware

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish are not affected b...

Shopware 授权问题漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware. Shopware is vulnerable to an access control error that stems from not properly setting sensitive HTTP headers to non-cacheable, which could be exploited by an attacker to enable HTTP caching and then have...

UBUNTU-CVE-2022-0001

Non-transparent sharing of branch predictor selectors between contexts in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...

UBUNTU-CVE-2022-0002

Non-transparent sharing of branch predictor within a context in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...

Important: kernel

Issue Overview: Amazon Linux has been made aware of a potential Branch Target Injection BTI issue sometimes referred to as Spectre variant 2. This is a known cross-domain transient execution attack where a third party may seek to cause a disclosure gadget to be speculatively executed after an...

CVE-2021-3738

In DCE/RPC it is possible to share the handles cookies for resource state between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only...

ALPINE-CVE-2021-3738

In DCE/RPC it is possible to share the handles cookies for resource state between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only...

CVE-2021-3738

In DCE/RPC it is possible to share the handles cookies for resource state between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only...

CVE-2021-3738

CVE-2021-3738 affects Samba’s AD DC RPC server where memory could be freed in a sub-connection, leaving a stale struct session_info. Impact described as potential crash with a use-after-free that could allow higher-privilege state to be referenced. Affected context appears in Samba advisories and...

Covid app’s privacy information ruled not clear enough

The UKs data watchdog has issued a reprimand to both the Scottish government and NHS National Services Scotland about their Covid Status app. The Information Commissioners Office ICO urged both to act swiftly to address its concerns about the app that, according to the ICO, failed to provide peop...

WordPress Better Sharing plugin <= 1.7.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Better Sharing plugin versions = 1.7.1. Solution Update the WordPress Better Sharing plugin to the latest available version at least 1.7.2...

WordPress Better Sharing plugin <= 1.7.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Better Sharing plugin versions = 1.7.1. Solution Update the WordPress Better Sharing plugin to the latest available version at least 1.7.2...

PeerTube Access Control Error Vulnerability (CNVD-2022-18318)

PeerTube is a decentralized video sharing service platform. Peertube has an access control error vulnerability that stems from the product's failure to effectively check the status of videos, which could be exploited by attackers to increase the number of likes that modify private videos...

PT-2022-3872 · Atlassian · Crowd +6

Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo versions prior to 8.0.9 Atlassian Bamboo versions 8.1.0 through 8.1.8 Atlassian Bamboo versions 8.2.0 through 8.2.4 Atlassian Bitbucket versions prior to 7.6.16 Atlassian Bitbucket versions 7.7.0 through 7.17.8 Atlassian...

screen sharing on applications (Teams, WebEx and GoToMeeting) will not display screen properly until Workspace is minimized.

screen sharing on applications Teams, WebEx and GoToMeeting will not display screen properlyblack screen until Workspace is minimized...

FileCloud 信息泄露漏洞

FileCloud is an ultra-secure content collaboration platform from US-based FileCloud, Inc. offering industry-leading compliance, data governance, data leakage protection, data retention and digital rights management capabilities. FileCloud suffers from a security vulnerability that stems from the...

Security Bulletin: OpenSSL vulnerabilities affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center)

Summary Multiple OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL, used by IBM Spectrum Control formerly Tivoli Storage Productivity Center, has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-1552 DESCRIPTION: OpenSSL has internal defaults for a directo...