CVE-2021-30297

CVE-2021-30297 is a Qualcomm/ Snapdragon VR service vulnerability: an out-of-bounds read caused by improper validation of the data transfer packet length in the VR service. Affected are Snapdragon platforms including Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, and Wearables. CVSS d...

CVE-2021-30297

Possible out of bound read due to improper validation of packet length while handling data transfer in VR service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables...

UnionToken should check whitelist on from?

Handle cmichel Vulnerability details The UnionToken can check for a whitelist on each transfer in beforeTokenTransfer: if whitelistEnabled requireisWhitelistedmsg.sender || to == address0, "Whitelistable: address not whitelisted"; This whitelist is checked on msg.sender not on from, the token...

[SECURITY] Fedora 34 Update: containerd-1.5.7-1.fc34

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

Oracle Essbase 安全漏洞

Oracle Essbase is an application from Oracle Corporation Oracle. enables organizations to quickly generate insights from multidimensional data sets using what-if analysis and data visualization tools. A security vulnerability exists in Oracle Essbase's Essbase Administration Services product that...

Users could lose funds if owner took out reward which is not multiplier of allocatedTokensPerEpoch

Handle xYrYuYx Vulnerability details Impact User could lost funds if owner take reward which is not multiplier of allocatedTokensPerEpoch. Proof of Concept This is my test case to proof this issue. This issue occur because of Line 104 Ex. If allocatedTokensPerEpoch is 1 CQT. and now available epo...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, and other functions. A security vulnerability in the Oracle Content Manag...

Oracle WebLogic Server 输入验证错误漏洞

Oracle WebLogic Server is an Oracle application services middleware for cloud and traditional environments that provides a modern, lightweight development platform that supports the entire lifecycle management of applications from development to production and simplifies application deployment an...

Devolutions Remote Desktop Manager 安全漏洞

Devolutions Remote Desktop Manager is an application from Devolutions Canada. It provides remote desktop management functionality. A security vulnerability exists in Devolutions Remote Desktop Manager, which stems from incomplete permission checking of entries in the "Transfer Remote Desktop...

LedgerSMB 安全漏洞

LedgerSMB is a free web-based double-entry bookkeeping system with quoting, ordering, invoicing, projects, time cards, inventory management, shipping, and more. A security vulnerability exists in LedgerSMB that stems from LedgerSMB not setting the Secure attribute on the session authorization...

Mozilla: Downgrade attack on SMTP STARTTLS connections

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication...

CVE-2021-35495

The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server fo...

CVE-2021-38178

The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious...

CVE-2021-38178

The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious...

CVE-2021-38178

The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious...

TIBCO Software JasperReports Server 访问控制错误漏洞

Tibco Software TIBCO Software JasperReports Server is an embeddable reporting server from TIBCO Software Tibco Software Inc. that provides reporting and analytics capabilities that can be embedded into web or mobile devices. An access control error vulnerability exists in various TIBCO Software...

Mozilla Thunderbird 安全漏洞

Mozilla Thunderbird is a suite of email client software from the Mozilla Foundation that is separate from the Mozilla Application Suite. The software supports IMAP and POP email protocols as well as HTML email formats. Mozilla Thunderbird is vulnerable to an information disclosure vulnerability...

Fee on transfer tokens do not work within the protocol

Handle tensors Vulnerability details Fee on transfer tokens transfer less tokens in than what would be expect. This means that the protocol request incorrect amounts when dealing with these tokens. The protocol should use stored token balances instead of transfer for calculating amounts. --- The...

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations exposing possibly sensitive data in clear text over the network.

...

Huawei Pc Smart Full Scene 路径遍历漏洞

A path traversal vulnerability exists in Huawei Pc Smart Full Scene version 11.1, a full-scene intelligence solution from Huawei China. The vulnerability stems from an input validation error when the program handles directory traversal sequences. A remote attacker could exploit the vulnerability ...