Parallels Desktop Tools Integer Overflow Elevation of Privilege Vulnerability (CNVD-2021-34188)

Parallels Desktop is a virtual machine software that runs on Mac computers. A security vulnerability exists in the Parallels Tools component of Parallels Desktop version 16.1.2-49151. The vulnerability stems from a lack of proper validation of user-supplied data. An attacker can exploit the...

Parallels Desktop IDE Out-of-Bounds Read Information Disclosure Vulnerability (CNVD-2021-34192)

Parallels Desktop is a virtual machine software that runs on Mac computers. An information disclosure vulnerability exists in the IDE virtual appliance in Parallels Desktop version 15.1.5-47309. The vulnerability stems from a lack of proper validation of user-supplied data. A local attacker could...

pfSense cross-site scripting vulnerability (CNVD-2021-33242)

pfSense is a set of network firewalls based on FreeBSD Linux. A cross-site scripting vulnerability exists in pfsense version 2.5.0, which stems from not sufficiently sanitizing user-supplied data passed to the serviceswoledit.php script via the Description field. An attacker could exploit this...

TYPO3 跨站脚本漏洞

TYPO3 is a free and open source content management system framework from the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in version 1.x prior to TYPO3 1.3.3, which stems from insufficient innocuous handling of user-supplied data, and can be exploited by attackers to condu...

Apple WebKitGTK+ 跨站脚本漏洞

WebKitGTK+ is a full-featured port of the WebKit engine and contains all of WebKit's features. A cross-site scripting vulnerability exists in WebKitGTK+ that stems from insufficient harmless handling of user-supplied data in WebKit. The following products and versions are affected: WebKitGTK+:...

ToxicEye RAT hits Telegram app to spy, steal user data

By Habiba Rashid ToxicEye is a new remote access Trojan RAT malware targeting Telegram app users - The RAT has been used for more than 130 attacks over the past three months. This is a post from HackRead.com Read the original post: ToxicEye RAT hits Telegram app to spy, steal user data...

CVE-2021-22204

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...

CVE-2021-22678

Cscape All versions prior to 9.90 SP4 lacks proper validation of user-supplied data when parsing project files. This could lead to memory corruption. An attacker could leverage this vulnerability to execute code in the context of the current process...

CVE-2021-22204

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...

CVE-2021-22204

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image...

Cscape Memory Corruption Vulnerability

Cscape is an application that can program the full range of OCS. A memory corruption vulnerability exists in Cscape versions prior to 9.90 SP4. The vulnerability stems from the affected application failing to properly validate user-supplied data when parsing a project file. An attacker can exploi...

WordPress: PII of users can be downloaded from export pages

Sensitive personally identifiable information PII of users, including their name, email, phone number, role, and organization, was exposed on the https://doaction.org/ website. The PII was found in CSV files that could be downloaded from various endpoints on the website, which could be enumerated...

Magento-lts SQL Injection Vulnerability

Magento lts is a long term support alternative to Magento Community Edition CE. A SQL injection vulnerability exists in Magento-lts. The vulnerability stems from insufficient handling of user-supplied data in the "lib/Varien/Db/Adapter/Pdo/Mysql.php" script when processing field names. An attacke...

CVE-2021-29437

ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user for Scratch username. 3. 3rd party site pretends to be us...

CVE-2021-29437

ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user for Scratch username. 3. 3rd party site pretends to be us...

Siemens Solid Edge PAR File Stack Buffer Overflow Vulnerability

Siemens Solid Edge is a 3D CAD software. The software can be used in the industries of part design, assembly design, sheet metal design, welding design, and so on. A stack buffer overflow vulnerability exists in the Siemens Solid Edge PAR file heap. The vulnerability is due to a lack of proper...

Siren Federate 安全漏洞

Siren Federate is an application from Siren Ireland. It extends the Elasticsearch API to add high performance and scalable joins. A security vulnerability exists in Siren Federate that discloses user information across thread contexts when a low-privileged user and a high-privileged user execute...

Siemens Solid Edge PAR File Out-of-Bounds Write Vulnerability

Siemens Solid Edge is a 3D CAD software. The software can be used in the industries of part design, assembly design, sheet metal design, welding design, and so on. An out-of-bounds write vulnerability exists in Siemens Solid Edge PAR files. The vulnerability is due to a lack of proper validation ...

Improper access control

The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to delete the data of another user that are present in the same table through...

CVE-2021-25374

An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O8.1 and below, and 3.9.00.9 in Android P9.0 and above allows remote attackers to access a user data related with Samsung Account...