CVE-2020-21605

libde265 v1.0.4 contains a segmentation fault in the applysaointernal function, which can be exploited via a crafted a file...

Johnson Controls Sensormatic Electronics Illustra

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls, Inc. Equipment: Illustra Vulnerability: Off-by-one Error 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a local attacker to...

IBM AIX Denial of Service Vulnerability (CNVD-2021-88194)

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. A denial of service vulnerability exists in IBM AIX version 7.1, 7.2, and VIOS version 3.1. A local attacker could exploit this vulnerability to cause a denial of service...

CVE-2021-28589 Adobe Media Encoder TS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe Media Encoder version 15.2 and earlier is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue...

HolesWarm Malware Exploits Unpatched Windows, Linux Servers

By leveraging more than 20 known vulnerabilities in Linux and Windows servers, the HolesWarm cryptominer malware has been able to break into more than 1,000 cloud hosts just since June. The basic cryptominer botnet has been so successful at juggling so many different known vulnerabilities between...

Auth Bypass Bug Exploited, Millions of Routers Affected

An authentication-bypass vulnerability affecting multiple routers and internet-of-things IoT devices is being actively exploited in the wild, according to researchers. The security flaw, tracked as CVE-2021-20090, was disclosed last week by researchers at Tenable. It affects devices from 20...

Code injection

IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in Korn Shell ksh to gain root privileges. IBM X-Force ID: 201478...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2021-51483)

Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. A remote code execution vulnerability exists in Microsoft Exchange Server. An attacker could exploit this vulnerability to achieve remote code execution...

Online Covid Vaccination Scheduler System 1.0 Shell Upload

Exploit Title: Online Covid Vaccination Scheduler System 1.0 - Arbitrary File Upload to Remote Code Execution Unauthenticated Date: 2021-07-07 Exploit Author: faisalfs10x Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2021-48862)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A buffer overflow vulnerability exists in Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4, which can be exploited by an attacker to trigger undefined behavior via a null pointer bound to...

Navigate CMS SQL Injection Vulnerability

Navigate CMS is a powerful and intuitive content management system. A SQL injection vulnerability exists in Navigate CMS version 2.9. The vulnerability can be exploited to conduct SQL injection attacks via URL-encoded GET input categories in navigate.php...

Google Android sspRequestCallback Information Disclosure Vulnerability

Google Android is a Linux-based open source operating system from the Google Open Handheld Consortium Google. An information disclosure vulnerability exists in Google Android sspRequestCallback. An attacker can exploit this vulnerability to cause information disclosure...

Google Android Information Disclosure Vulnerability (CNVD-2021-45314)

Google Android is a Linux-based open source operating system from the Google Open Handheld Consortium Google. Google Android suffers from an information disclosure vulnerability. The vulnerability stems from a lack of permission checking in updateNotification in BeamTransferManager.java. An...

Google Android phNxpNciHal.cc Elevation of Privilege Vulnerability

Google Android is a Linux-based open source operating system from the Google Open Handheld Consortium Google. An elevation of privilege vulnerability exists in Google Android phNxpNciHal.cc. An attacker can exploit this vulnerability to cause a local elevation of privilege...

Unauthorized Access Vulnerability in M4080FX of Samsung (China) Investment Co.

The M4080FX is an all-in-one printer from Samsung China Investment Co. An unauthorized access vulnerability exists in the Samsung China Investment Co. M4080FX, which can be exploited by attackers to obtain sensitive information...

Google Android elevation of privilege vulnerability (CNVD-2021-45299)

Google Android is a Linux-based open source operating system from the Google Open Handheld Consortium Google. An elevation of privilege vulnerability exists in Google Android 11. The vulnerability arises due to a privilege bypass in sendBugreportNotification of BugreportProgressService.java. An...

RIOT Buffer Overflow Vulnerability (CNVD-2021-44277)

RIOT is a real-time multi-threaded IoT operating system that supports a range of devices commonly found in the Internet of Things. RIOT suffers from a buffer overflow vulnerability. An attacker can exploit this vulnerability to obtain sensitive information...

Unauthorized Access Vulnerability in Fuji Xerox (China) Limited DocuCentre-V 3060

Fuji Xerox China Co., Ltd. was established on January 3, 1995 as a wholly-owned holding company of Fuji Xerox in China with a registered capital of US$39 million. Fuji Xerox China Co., Ltd. is headquartered in Beijing. An unauthorized access vulnerability exists in the Fuji Xerox China Limited...

Ec-cube cross-site scripting vulnerability (CNVD-2021-46278)

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . Ec-cube suffers from a cross-site scripting vulnerability that can be exploited by an attacker to trick a victim into following a specially crafted link and executing arbitrary HTML and script code in the user's browser...

Wire cross-site scripting vulnerability (CNVD-2021-44982)

Wire is a chat software by an individual developer. The program supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos, and its original way of saying hello, PING. A cross-site scripting vulnerability exists in wire-webapp, which can be...