CVE-2021-32517

Improper access control vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files using particular parameter in download function. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

Vulnerabilities fixed in Dell Wyse Management Suite

Dell has fixed vulnerabilities in Dell Wyse Management Suite. An authenticated remote malicious person could potentially potentially exploit them to perform a path traversal attack. This could gain read access to arbitrary files on the system. Dell has released updates to fix the vulnerabilities ...

CVE-2021-24386

The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to...

Monstra CMS 跨站脚本漏洞

Monstra is a lightweight content management system CMS. A cross-site scripting vulnerability exists in Monstra version 3.0.4. The vulnerability can be exploited to conduct cross-site scripting attacks via the page function in admin/index.php...

SELinux Resource Management Error Vulnerability (CNVD-2021-52406)

SELinux is a Linux subsystem from the National Security Agency that uses a secure architecture that allows administrators to better control who has access to the system. A security vulnerability exists in SELinux version 3.2, which stems from a use-after-free in the SELinux CIL compiler in the...

UBUNTU-CVE-2018-25017

RawSpeed aka librawspeed 3.1 has a heap-based buffer overflow in TableLookUp::setTable...

SELinux 缓冲区错误漏洞

SELinux is a Linux subsystem from the National Security Agency that uses a secure architecture that allows administrators to better control who has access to the system. A security vulnerability exists in SELinux version 3.2, which stems from a heap-based buffer overflow in the CIL compiler in...

SELinux 资源管理错误漏洞

SELinux is a Linux subsystem of the National Security Agency that utilizes a secure architecture that allows administrators to better control who has access to the system. A security vulnerability exists in SELinux version 3.2, which stems from the CIL compiler of SELinux having an after-free in...

UBUNTU-CVE-2021-3630

An out-of-bounds write vulnerability was found in DjVuLibre in DJVU::DjVuTXT::decode in DjVuText.cpp via a crafted djvu file which may lead to crash and segmentation fault. This flaw affects DjVuLibre versions prior to 3.5.28...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Craft CMS is a content management system for developers, designers and web professionals that provides flexibility, power and ease of use. A cross-site scripting vulnerability exists in a front-end form that accepts user uploads in versions of Craft CMS prior to 3.6.0. Detailed vulnerability...

getsimplecms 跨站脚本漏洞

GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A cross-site scripting vulnerability exists in admin/changedata.php in GetSimple CMS 3.3.15 and earlier versions. The vulnerability can be exploited to conduct cross-site scripting attacks via the...

A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13.

...

74CMS SQL Injection Vulnerability

74CMS is a talent recruitment system based on the second development of ThinkPHP framework. A SQL injection vulnerability exists in 74CMS version 3.2.0. An attacker can use this vulnerability to inject SQL statements via the id parameter of wap/wap-company-show.php...

ECShop SQL Injection Vulnerability (CNVD-2021-44948)

ECShop is a professional e-commerce mall system. A SQL injection vulnerability exists in ECShop version 3.0. An attacker can exploit this vulnerability by using the id parameter of admin/shophelp.php to perform SQL injection attacks...

ECShop SQL Injection Vulnerability (CNVD-2021-44949)

ECShop is a professional e-commerce mall system. A SQL injection vulnerability exists in ECShop version 3.0. An attacker can exploit this vulnerability by using the aid parameter of admin/affiliateck.php to conduct SQL injection attacks...

CVE-2020-22212

SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php...

ECShop SQL注入漏洞

ECShop is a professional e-commerce mall system. A SQL injection vulnerability exists in ECShop version 3.0. An attacker can exploit this vulnerability by using the aid parameter of admin/affiliateck.php to conduct SQL injection attacks...

Stored XSS vulnerability in scriptler

scriptler 3.1 and earlier does not escape script content. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Scriptler/Configure permission. scriptler 3.2 escapes script content...

CVE-2021-0133

Key exchange without entity authentication in the IntelR Security Library before version 3.3 may allow an authenticated user to potentially enable escalation of privilege via network access...

GHSA-RXJP-MFM9-W4WR Path Traversal in Django

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names...