Mozilla: A crafted OpenPGP key with an invalid user ID could be used to confuse the user

Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbi...

Mozilla Thunderbird 数据伪造问题漏洞

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. Mozilla Thunderbird has a security vulnerability that allows an attacker to create a...

RHEL 8 : thunderbird (RHSA-2021:1193)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1193 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.9.1. Security Fixes: Mozilla: ...

RHEL 8 : thunderbird (RHSA-2021:1190)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1190 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.9.1. Security Fixes: Mozilla: ...

ShopXO 安全漏洞

ShopXO is an open source enterprise-level open source e-commerce system. Shopxo v1.4.0 and v1.5.0 has an Access Control Error vulnerability, which can be exploited to obtain privileges in "index.php" by manipulating the parameter "user id" in the HTML request...

CVE-2021-23992

Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbi...

Mozilla Thunderbird Security Bypass Vulnerability

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. Mozilla Thunderbird has a security vulnerability that allows an attacker to create a...

The vulnerability of Containerd’s execution environment, related to the lack of privilege checks for containers with UID 0 in the same namespace as the shim, allows a attacker to access confidential data and compromise its integrity.

The vulnerability of Containerd’s execution environment is related to the lack of privilege checks for containers with UID 0 in the same namespace as the shim. Exploiting this vulnerability allows an attacker to access confidential data and compromise its integrity...

Vulnerability of the check_output function in output.c. SUID in a isolated programming environment. Firejail, due to the lack of measures to neutralize special elements, allows a violator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability in the checkoutput function of output.c, with the SUID attribute and a isolated programming environment like Firejail, is related to the lack of measures to neutralize special elements. Exploiting this vulnerability can allow an attacker to access confidential data, compromise i...

Vulnerability of the check_output function in output.c. SUID in a isolated programming environment. Firejail, due to the lack of measures to neutralize special elements, allows a violator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability in the checkoutput function in output.c. The SUID attribute in the isolated programming environment of Firejail indicates that there are no measures in place to neutralize this vulnerability. Exploiting this vulnerability could allow a remote attacker to access confidential data...

CVE-2021-21396 Bulk list client endpoint exposes too much metadata about a client

wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the GET /users/list-clients endpoint. The endpoint could be used by any logged in user who could...

PT-2021-17835 · Ca · Ca Ehealth Performance Manager

Name of the Vulnerable Software and Affected Versions: CA eHealth Performance Manager versions 6.3.2.12 and earlier Description: The issue is related to Privilege Escalation via a setuid and/or setgid file. When a component is run as an argument of the runpicEhealth executable, the script code wi...

CVE-2021-21376

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information...

GHSA-GFP2-W5JM-955Q OMERO.web exposes some unnecessary session information in the page

Background OMERO.web loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. Some additional information being loaded is not used by the webclient and is being removed in this release. Impact OMERO.we...

The vulnerability of the setuid function in the UNIX command shell Zsh allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failure.

The vulnerability of the setuid function in the UNIX command shell Zsh is related to incorrect reallocation of the user ID. Exploitation of this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

CVE-2021-20263

creationtimestamp| type| source ---|---|--- 2021-03-09 20:52:02+00:00| seen| https://t.me/cibsecurity/24633...

CVE-2019-25021

creationtimestamp| type| source ---|---|--- 2021-02-27 07:39:54+00:00| seen| https://t.me/cibsecurity/24270...

Soar Cloud System Access Control Error Vulnerability

Soar Cloud System is a HR system solution system developed by Soar. Soar Cloud System HR Portal has an access control error that allows remote attackers to access sensitive data through specific packets e.g., user's login information while obtaining a user ID, thus preventing the login function...

Gitea 1.12.5 Remote Code Execution

Exploit Title: Gitea 1.12.5 - Remote Code Execution Authenticated Date: 17 Feb 2020 Exploit Author: Podalirius PoC demonstration article: https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/ Vendor Homepage: https://gitea.io/ Software Link:...

Juniper Networks Junos OS Authorization Issues Vulnerability

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The OS provides a secure programming interface and the Junos SDK. Junos OS contains an authorization issue vulnerability that can be exploited by an attacker to elevate privileges bypassin...