CVE-2021-39013

IBM Cloud Pak for Security CP4S 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651...

WordPress WP Sitemap Page Plugin < 1.7.0 XSS Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

PT-2021-23142 · Snudown · Snudown

Name of the Vulnerable Software and Affected Versions: Snudown versions prior to 1.7.0 Description: Snudown, a reddit-specific fork of the Sundown Markdown parser, is vulnerable to denial of service attacks due to its reference table implementation. The hash table used for references written in...

CVE-2021-3747

The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner...

Multipass 安全漏洞

Multipass is a lightweight vm manager for Linux, Windows and MacOS. A security vulnerability exists in the MacOS version of Multipass version 1.7.0...

CVE-2021-35940

An out-of-bounds array read in the aprtimeexp functions was fixed in the Apache Portable Runtime 1.6.3 release CVE-2017-12613. The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue...

Apache Portable Runtime 缓冲区错误漏洞

Apache Portable Runtime APR, Apache Portable Runtime Library is an Apache Foundation library that provides an underlying support interface for upper-level applications that can be used across multiple operating system platforms. a security vulnerability exists in Apache Portable Runtime version...

PT-2021-21068

Name of the Vulnerable Software and Affected Versions: Apache Portable Runtime versions 1.7.0 Apache Portable Runtime versions prior to 1.6.3 Description: The issue is related to an out-of-bounds array read in the apr time exp functions. This problem was previously fixed in the Apache Portable...

PT-2021-10211 · Unknown · Minewebcms

Name of the Vulnerable Software and Affected Versions: MineWebCMS version 1.7.0 Description: The issue allows remote attackers to execute arbitrary code by injecting malicious code into the Title field of the component "/admin/news". This enables attackers to perform Cross Site Scripting XSS...

requests 代码问题漏洞

requests is an elegant and simple HTTP library for humans from the Python Foundation. With requests, you can send HTTP / 1.1 requests very easily. There is no need to manually add query strings to your URLs or form-encode POST data. Requests inventory is vulnerable to a code issue that stems from...

Arbitrary Code Injection

Overview xmlhttprequest is a wrapper for the built-in http client to emulate the browser XMLHttpRequest object. Affected versions of this package are vulnerable to Arbitrary Code Injection. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.sen...

Dan DeFelippi node-XMLHttpRequest 代码注入漏洞

Dan DeFelippi node-XMLHttpRequest is Dan DeFelippi an open source application . Used to simulate the browser XMLHttpRequest object . A code injection vulnerability exists in node-XMLHttpRequest before 1.7.0, which can be exploited by an attacker to cause arbitrary code to be injected and run...

CVE-2020-29134

The TOTVS Fluig platform allows path traversal through the parameter “file = .. /” encoded in base64. This affects all versions Fluig Lake 1.7.0, Fluig 1.6.5 and Fluig 1.6.4 Recent assessments: lucxssouza at March 24, 2021 6:54pm UTC reported: Assessed Attacker Value: 5 Assessed Attacker Value:...

PT-2021-2232 · Picotcp · Picotcp

Name of the Vulnerable Software and Affected Versions: PicoTCP version 1.7.0 Description: The issue is related to the improper randomness of TCP Initial Sequence Numbers ISNs in the PicoTCP stack implementation. This could potentially allow a remote attacker to gain unauthorized access to protect...

picoTCP Input Validation Error Vulnerability

Altran EESY Belgium Picotcp is a software from the Altran EESY Belgium community that provides TCP/IP protocol support for real-time systems. An input validation error vulnerability exists in picoTCP version 1.7.0, which arises from a network system or product that does not properly validate...

HashiCorp Consul Enterprise Denial of Service Vulnerability

HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp USA. The product is used to connect and provision applications across a dynamically distributed infrastructure. A security vulnerability exists in HashiCorp Consul Enterprise versions 1.7.0...

Design/Logic Flaw

HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5...

fs.com S3900-24T4S Cross-Site Request Forgery Vulnerability

The fs.com S3900-24T4S is a Gigabit stackable switch from China's Feixiang Innovation fs. fs S3900-24T4S switch is equipped with 24 10/100/1000Base-T ports, 4 10G SFP+ uplink ports, supports up to 6 switches stacking, and is easy to operate with highly secure service processing capability, flexib...

CVE-2020-8228

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...

Security Bulletin: WML CE: TensorFlow: In SQLite before 3.32.3, select.c mishandles query-flattener optimization

Summary In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation. TensorFlow in WML CE uses SQLite as its embedded SQL database engine. Vulnerability Details CVEID:...