AZL-6746 CVE-2020-12403 affecting package nss for versions less than 3.44-10

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and strictly enforcing tag length...

CVE-2021-24282

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7rresetsettings to reset the plugin’s settings, wpcf7raddaction to...

WordPress plugin 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A PHP object injection vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...

UBUNTU-CVE-2021-21424

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. ...

多款 Siemens 设备资源管理错误漏洞

Siemens SIMATIC is a Siemens Siemens configuration software. A resource management error vulnerability exists in multiple Siemens devices. An attacker could send specially crafted packets that would result in a denial of service condition on TCP port 102. The following products and versions are...

CVE-2020-4979

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to comprimise or spoof traffic between hosts may be able to execute arbitrary commands. IBM X-Force D: 192538...

Zulip 安全漏洞

Zulip server is an open source team chat application from the American company Zulip. A security vulnerability exists in Zulip Server versions prior to 3.4 that stems from a public API that causes guest users to be able to receive message traffic from a public stream that should only be accessibl...

WordPress插件 跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . Cross-site request forgery vulnerability exists in the...

USN-4754-1 python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities

It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. CVE-2020-27619, CVE-2021-3177...

Veritas Resiliency Platform 安全漏洞

Veritas Technologies Resiliency Platform VRP is a suite of data protection solutions from Veritas Technologies, USA. A security vulnerability exists in Veritas Resiliency Platform versions 3.4 and 3.5, which can be exploited by an attacker to gain administrator access to the system, resulting in...

DEBIAN-CVE-2020-35495

There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34...

QNAP Systems TS-870 Cross-Site Scripting Vulnerability (CNVD-2020-62488)

QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site scripting vulnerability exists in the QNAP Systems TS-870 using firmware version 4.3.4.0486. The vulnerability stems from a lack of proper validation of client data by the WEB application...

PYSEC-2020-267

Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By...

USN-4581-1 python2.7, python3.4, python3.5, python3.6 vulnerability

It was discovered that Python incorrectly handled certain character sequences. A remote attacker could possibly use this issue to perform CRLF injection...

PT-2020-13428 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A vulnerability was discovered that allows project reporters and above to see confidential EPIC attached to confidential issues...

UBUNTU-CVE-2020-15136

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints...

Easy Property Listings Cross-Site Request Forgery Vulnerability

Easy Property Listings is a property listings plugin. A cross-site request forgery vulnerability exists in versions prior to Easy Property Listings 3.4. The vulnerability stems from a web application that does not adequately validate that a request is coming from a trusted user. An attacker could...

CVE-2019-14765

Incorrect Access Control in AfficheExplorateurParam in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use administrative controllers...

Linux kernel memory leak vulnerability (CNVD-2019-41275)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A memory disclosure vulnerability exists in the nfpflowerspawnvnicreprs function in...

SQL Injection Vulnerability in Seven Bears Library System v3.4

Seven bears is similar to Baidu library, can realize the document sharing, selling library CMS system. After the user uploads the source document, seven bears will automatically transcode the document into HTML, after the success of the document HTML back to the library CMS. to realize...