Security Bulletin: IBM® Db2® is vulnerable to an information disclosure, exposing remote storage credentials to privileged users under specific conditions.(CVE-2021-29752)

Summary IBM® Db2® is vulnerable to an information disclosure, exposing remote storage credentials to privileged users under specific conditions.CVE-2021-29752 Vulnerability Details CVEID: CVE-2021-29752 DESCRIPTION: IBM Db2 contains an information disclosure vulnerability, exposing remote storage...

多款Bosch产品安全漏洞

Bosch Access Professional Edition and others are products of Bosch, Germany.Bosch Access Professional Edition is an enterprise access control and security management solution.Bosch VRM is an application.Bosch BVMS is an application... system. A security vulnerability exists in a number of Bosch...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux Kernel that can be exploited by a local attacker with special user privileges to bypass authentication and potentially cause an err...

SUSE: Security Advisory (SUSE-SU-2021:3943-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Directory traversal

Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special...

CVE-2021-43800 Asset directory traversal with some storage modules on Windows

Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special...

SUSE-SU-2021:3927-1 Security update for php74

This update for php74 fixes the following issues: - CVE-2021-21707: Fixed special character breaks path in xml parsing bsc1193041...

D-Link DIR-809 formStaticDHCP Buffer Overflow Vulnerability

D-Link DIR-809 is a dual-band router from D-Link, China. buffer overflow vulnerability exists in the fun80034d60 function in the D-Link DIR-809 formStaticDHCP, which can be exploited by attackers to submit special requests that can crash applications or execute arbitrary code...

CVE-2021-20609

Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120ENCPU, MELSEC iQ-R Series R08/16/32/120SFCPU, MELSEC iQ-R Series R08/16/32/120PCPU, MELSEC iQ-R Series R08/16/32/120PSFCPU, MELSEC iQ-R Series R16/32/64MTCPU,...

CVE-2021-43358

Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download system files...

Advanced Comment System 1.0 - Remote Command Execution Exploit

Exploit Title: Advanced Comment System 1.0 - Remote Command Execution RCE Exploit Author: Nicole Daniella Murillo Mejias Version: Advanced Comment System 1.0 Tested on: Linux !/usr/bin/env python3 DESCRIPTION: Commands are Base64 encoded and sent via POST requests to the vulnerable application, t...

Path Traversal

S3Scanner is vulnerable to path traversal. An attacker can save files outside the folder specified with --dump-dir via a crafted bucket when the ListBucketResult element contains special characters...

CVE-2021-43358

Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download system files...

The vulnerability of Adobe After Effects’ video and dynamic image editing software relates to the manipulation of the null pointer, allowing attackers to cause service failures.

The vulnerability of Adobe After Effects video and dynamic image editing software relates to the handling of a special pointer. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2021-32037

Removed by vendor...

User may trigger invariant when allowed to send commands directly to shards

An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually, the requests are sent via mongos and special privileges are required in order to know the address of the shards and to log in to the shar...

MGASA-2021-0519 Updated php packages fix security vulnerability

Header injection via defaultmimetype / defaultcharset mbstring may use pointer from some previous request Unexpected behavior with arrays and JIT Special character is breaking the path in xml function CVE-2021-21707 XMLReader::getParserProperty may throw with a valid property...

Updated php packages fix security vulnerability

Header injection via defaultmimetype / defaultcharset mbstring may use pointer from some previous request Unexpected behavior with arrays and JIT Special character is breaking the path in xml function CVE-2021-21707 XMLReader::getParserProperty may throw with a valid property...

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function

...

Cross-site Scripting (XSS)

getkirby/kirby is vulnerable to cross-site scripting. The library does not properly escape HTML special characters, allowing an attacker to inject and execute malicious javascript. test...