PT-2021-14871 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 7.14.0 Description: A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information...

CVE-2021-39203: Exposure of Sensitive Information to an Unauthorized Actor

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This...

PDF Viewer Heap Buffer Overflow Unauthorized Access

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2019, and Adobe Acrobat Reader 2019 are related to the execution of operations beyond the buffer in memory. Exploiting these vulnerabilities can allow...

PDF viewer Buffer Overflow Information Disclosure

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are related to reading data beyond the buffer limit in memory. Exploiting these vulnerabilities can allow an attacker to gain...

OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host (Networking, 8258432)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows...

FortiMail IBE Bypass Unauthorized Access

The vulnerability of the FortiMail IBE Identity-Based Encryption service of the FortiMail email protection system is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow an attacker to bypass the cryptographic encryption mechanisms...

Node.js uv__idna_toascii() Heap Buffer Overflow DoS

The vulnerability of the uvidnatoascii function on the Node.js platform is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information or cause service failures...

PDF Memory Leak Unauthorized Access

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, and Adobe Acrobat Reader 2017 are related to the use of memory after it is freed. Exploiting these vulnerabilities can allow an attacker to gain...

CVE-2020-36440

An issue was discovered in the libsbc crate before 0.1.5 for Rust. For Decoder, it implements Send for any R: Read...

DevTools Google Chrome Unauthorized Access

The vulnerability of the DevTools suite for web development in the Google Chrome web browser relates to the use of memory after it is released. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by opening a specially created malicious web...

CVE-2021-22517

A potential unauthorized privilege escalation vulnerability has been identified in Micro Focus Data Protector. The vulnerability affects versions 10.10, 10.20, 10.30, 10.40, 10.50, 10.60, 10.70, 10.80, 10.0 and 10.91. A privileged user may potentially misuse this feature and thus allow unintended...

PT-2021-15120

Name of the Vulnerable Software and Affected Versions Micro Focus Data Protector versions 10.0 through 10.91 Description A potential unauthorized privilege escalation issue has been identified. This could allow a privileged user to misuse a feature, resulting in unintended and unauthorized access...

Cybozu Garoon Bulletin Operational Restriction Bypass Vulnerability

An operational restriction bypass vulnerability exists in Bulletin in Cybozu Garoon, a portal-based OA office system of Cybozu Japan. An attacker can use this vulnerability to change the data in the bulletin without proper privileges...

Cybozu Garoon input validation vulnerability

A security vulnerability exists in the User Profile of Cybozu Garoon, a portal-based OA office system from Cybozu Japan. An attacker can use this vulnerability to change data in the user profile without proper privileges...

PT-2021-6424 · Oracle +1 · Mysql Cluster +1

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 7.4.34 and prior MySQL Cluster versions 7.5.24 and prior MySQL Cluster versions 7.6.20 and prior MySQL Cluster versions 8.0.27 and prior Description: The issue allows a high-privileged attacker with access to the physic...

PT-2021-16973

Name of the Vulnerable Software and Affected Versions SourceCodester Simple College Website version 1.0 Description The issue allows remote attackers to execute arbitrary SQL statements via the id parameter to "news.php" API endpoint. This enables attackers to manipulate database queries,...

CVE-2021-2435

Vulnerability in the Essbase Analytic Provider Services product of Oracle Essbase component: JAPI. The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Essbase Analytic Provider Services...

CVE-2021-2434

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: Application Service. Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2021-2445

Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion component: Lifecycle Management. The supported version that is affected is 11.2.5.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion...

CVE-2021-2434

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: Application Service. Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...