libheif 缓冲区错误漏洞

libheif is an ISO/IEC 23008-12:2017 HEIF file format decoder and encoder. libheif version 1.6.2 contains a buffer overflow vulnerability in the convertcolorspace function in heifcolorconversion.cc. An attacker can exploit this vulnerability to cause a denial of service and disclose sensitive...

PT-2021-17634 · Libxls +2 · Libxls +2

Name of the Vulnerable Software and Affected Versions: libxls version 1.6.2 readxl affected versions not specified Description: An issue was discovered in the xls getWorkSheet function within xls.c in libxls, allowing attackers to cause a denial of service via a crafted XLS file. This can lead to...

HashiCorp Vault 访问控制错误漏洞

Hashicorp HashiCorp Vault is a private key access management tool from the US-based Hashicorp. An Access Control Error vulnerability exists in HashiCorp Vault Enterprise that stems from the product's lack of privilege validation when reading license metadata from DR secondaries. An attacker could...

CVE-2021-33027

Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce...

Sylabs Singularity 安全特征问题漏洞

Sylabs Singularity is an open source container management platform from Sylabs, Inc. in the United States. The software supports building applications on their desktops and running hundreds or thousands of instances on any public cloud or at the compute edge. Sylabs Singularity Enterprise has a...

WordPress WP Prayer plugin cross-site scripting vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WP Prayer WordPress is an application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WP Prayer WordPress is an application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress...

Code injection

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

PT-2021-12011 · Unknown · Themegrill-Demo-Importer

Name of the Vulnerable Software and Affected Versions: themegrill-demo-importer versions prior to 1.6.2 Description: The issue allows unauthorized access to wipe the database due to a lack of authentication requirement in the reset wizard actions hook. Recommendations: For themegrill-demo-importe...

PT-2021-4109

Name of the Vulnerable Software and Affected Versions Pydantic versions prior to v1.6.2 Pydantic versions prior to v1.7.4 Pydantic versions prior to v1.8.2 Description The issue is related to the incorrect handling of 'infinity', 'inf', and float'inf' values in date fields, causing validation to...

CVE-2021-26905

1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...

CVE-2020-25594

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7...

CVE-2021-3024

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7...

CVE-2020-25594

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7...

CVE-2020-25594

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7...

flatpak security update

1.6.2-5 - Fix CVE-2021-21261 1918774...

Vault API Endpoint Allowed Enumeration of Secrets Engine Mount Paths Without Authentication

Summary Vault and Vault Enterprise “Vault” allowed the enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. This vulnerability, CVE-2020-25594, was fixed in Vault 1.6.2 & 1.5.7. Background Vault operators are able to mount Secrets Engines at customizable paths. Secrets...

PT-2020-16109 · Cmsuno · Cmsuno

Name of the Vulnerable Software and Affected Versions: CMSuno version 1.6.2 Description: The issue allows an attacker to inject malicious PHP code as a username while changing their username and password. After the attacker logs in to the application, their code will be executed, enabling an...

Security Bulletin: WML CE: TensorFlow: In SQLite before 3.32.3, select.c mishandles query-flattener optimization

Summary In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation. TensorFlow in WML CE uses SQLite as its embedded SQL database engine. Vulnerability Details CVEID:...

Security update for mp3gain (moderate)

openSUSE Security Update: Security update for mp3gain Announcement ID: openSUSE-SU-2020:0539-1 Rating: moderate References: 1154971 Cross-References: CVE-2017-12911 CVE-2019-18359 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes two vulnerabilities is now available...