GHSA-4F6X-49G2-99FM Cross-site Scripting in Mermaid

Mermaid before 8.11.0 allows XSS when the antiscript feature is used...

Header injection in nodemailer

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object...

Session Fixation

express-openid-connect is vulnerable to session fixation. The attack exists because the library does not regenerate the session id and cookie when user logs in, allowing a malicious user to hijack the session using earlier generated cookies...

CVE-2021-43542

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

MGASA-2021-0540 Updated nginx/vsftpd packages fix security vulnerability

ALPACA: Application Layer Protocol Confusion - Analyzing and Mitigating Cracks in TLS Authentication...

Protect

A buffer overflow CWE-121 in the TFTP client library of FortiOS, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments...

CVE-2021-43936

The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution...

OPENSUSE-SU-2021:3943-1 Recommended update for php7

This update for php7 fixes the following issues: - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM bsc1192050. - CVE-2021-21707: Fixed special character breaks path in xml parsing bsc1193041. - Added patch to prevent memory access violation in php7 when running test suite bsc1175508...

Authorization Bypass

jenkins is vulnerable to authorization bypass.The operations FilePathrenameTo and FilePathmoveAllChildrenTo only check read permission on the source path...

GHSA-F545-VPWP-R9J7 showdoc is vulnerable to URL Redirection to Untrusted Site

showdoc is vulnerable to URL Redirection to Untrusted Site...

bookstack is vulnerable to Cross-Site Request Forgery (CSRF)

bookstack is vulnerable to Cross-Site Request Forgery CSRF...

GHSA-WP4H-PVGW-5727 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution...

ASB-A-190404446

Bulletin has no description...

PUB-A-186530889

In getDeviceIdWithFeature of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User...

ASB-A-190404404

Bulletin has no description...

PUB-A-201537251

Bulletin has no description...

ASB-A-190404323

Bulletin has no description...

PUB-A-190408641

Bulletin has no description...

ASB-A-190403213

Bulletin has no description...

ASB-A-197868577

In osimalloc and osicalloc of allocator.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...