baserCMS vulnerable to cross-site scripting

Overview baserCMS provided by baserCMS Users Community contains a cross-site scripting vulnerability CWE-79. Akagi Yusuke of NTT-ME CORPORATION reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary...

DLA-2717-2 redis - regression update

Bulletin has no description...

CVE-2021-30594

Use after free in Page Info UI in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via physical access to the device...

GHSA-H6GG-FVF5-QGWF Data races in generator

The Generator type is an iterable which uses a generator function that yields values. In affected versions of the crate, the provided function yielding values had no Send bounds despite the Generator itself implementing Send. The generator function lacking a Send bound means that types that are...

CVE-2021-39136

baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are...

Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability

A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Application Policy Infrastructure Controller Cloud APIC could allow an authenticated, remote attacker with Administrator read-only credentials to elevate privileges on an affected system...

Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability

A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Application Policy Infrastructure Controller Cloud APIC could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due t...

Cisco Nexus 9000 Series Fabric Switches ACI Mode Arbitrary File Read Vulnerability

A vulnerability in the fabric infrastructure file system access control of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI mode could allow an authenticated, local attacker to read arbitrary files on an affected system. This vulnerability is due to improper acces...

Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability

A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller APIC or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability is due to improper input validation in the web UI. A...

OPENSUSE-SU-2021:2838-1 Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: - Update to version 9.4.43.v20210629 - CVE-2021-34429: URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. bsc1188438...

OPENSUSE-SU-2021:1187-1 Security update for libspf2

This update for libspf2 fixes the following issue: - CVE-2021-20314: A remote overflow in SPF parsing could lead to remote code execution bsc1189104...

JVN#97545738: Multiple cross-site scripting vulnerabilities in Movable Type

Movable Type provided by Six Apart Ltd. contains multiple cross-site scripting vulnerabilities listed below. Cross-site scripting vulnerability in Search screen CWE-79 - CVE-2021-20808 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS...

UBUNTU-CVE-2021-30884

The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history...

PT-2021-4468

Name of the Vulnerable Software and Affected Versions iOS versions prior to 15.0.2 iPadOS versions prior to 15.0.2 macOS Monterey versions prior to 12.0.1 iOS versions prior to 14.8.1 iPadOS versions prior to 14.8.1 tvOS versions prior to 15.1 watchOS versions prior to 8.1 macOS Big Sur versions...

PT-2021-18964 · Apple · Apple Macos +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.0.1 macOS Big Sur versions prior to 11.6.1 Description: The issue arises from a logic problem that has been addressed with improved restrictions, allowing an unprivileged application to potentially edit NVRAM...

Apple tvOS 信息泄露漏洞

Apple tvOS is a set of smart TV operating systems from the American company Apple Apple. An information disclosure vulnerability exists in a number of Apple products, where malicious apps may be able to read a user's game play data. The issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, tvOS 15.1,...

PT-2021-19039 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.0.1 macOS Big Sur versions prior to 11.6.2 Description: An out-of-bounds read issue was addressed with improved input validation, which may allow a malicious application to execute arbitrary code with system...

SUSE-SU-2021:2803-1 Security update for spice-vdagent

This update for spice-vdagent fixes the following issues: - CVE-2020-25650: memory DoS via arbitrary entries in activexfers hash table bsc1177780 - CVE-2020-25651: possible file transfer DoS and information leak via activexfers hash map bsc1177781 - CVE-2020-25652: possibility to exhaust file...

Denial Of Service (DoS)

Exiv2 is vulnerable to Denial Of Service DoS. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of...

CVE-2021-32728

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a privat...