CVE-2021-26036

CVE-2021-26036 affects Joomla! 2.5.0 through 3.9.27 due to missing input validation that can corrupt the usergroups table. Impact is described as a DoS via manipulation of usergroup data, with CVSS scores indicating NETWORK attack, low complexity, and availability impact HIGH in CVSS v3.1 (base 7...

CVE-2021-34527

CVE-2021-34527, known as PrintNightmare, is a Windows Print Spooler remote code execution vulnerability. The flaw allows an authenticated attacker to execute arbitrary code with SYSTEM privileges by abusing privileged file operations in the Print Spooler, enabling installation of programs, data a...

CVE-2021-30554

CVE-2021-30554 is a use-after-free in the WebGL component of the Chromium-based Chrome/Chromium engine, exploited via crafted HTML pages. Affected are Chrome/Chromium versions before 91.0.4472.114, with remote code execution risk tied to heap corruption. Google is aware of exploits in the wild; m...

Command execution vulnerability in TamronOS IPTV/VOD system (CNVD-2021-49564)

TamronOS IPTV/VOD system is a set of Linux kernel-based development of broadband operators, hotels, schools, live on-demand all-in-one solution, the system provides a variety of clients Android set-top box, TV, PC on-demand, cell phone on-demand to facilitate user access through different devices...

CVE-2021-35941

CVE-2021-35941 affects Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions). The issue is an unauthenticated administrator API that can perform a system factory restore, as described in public records and exploited in the wild in June 2021. CVSS metrics (3.1) ind...

File upload vulnerability exists in Panavision e-office (CNVD-2021-49104)

Panmicro e-office is a standard collaborative mobile office platform under Panmicro. A file upload vulnerability exists in Panmicro e-office, which can be exploited by an attacker to gain control of the server...

CVE-2021-32722

CVE-2021-32722 affects the MediaWiki extension GlobalNewFiles . Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are vulnerable to an uncontrolled resource consumption vulnerability: a high volume of page moves in a short time can overwhelm the database server due to improper load balan...

CVE-2021-34187

CVE-2021-34187 affects Chamilo LMS, specifically the file main/inc/ajax/model.ajax.php . The vulnerability allows SQL Injection via the parameters searchField , filters , or filters2 in Chamilo versions up to 1.11.14 . Exploitation could enable unauthenticated attackers to manipulate queries and ...

CVE-2021-35501

Pandora FMS affects

CVE-2021-34427

CVE-2021-34427 affects Eclipse BIRT up to version 4.8.0. A JSP-injection flaw lets an attacker, via crafted query parameters, create a JSP file in the remote viewer directory and inject code, enabling remote code execution and potential server compromise. Exploitation details are documented in th...

CVE-2020-22165

Summary: CVE-2020-22165 affects PHPGurukul Hospital Management System v4.0. The vulnerability is a SQL injection in the hms\user-login.php page that allows remote, unauthenticated attackers to obtain sensitive data from the database. What’s affected: PHPGurukul Hospital Management System in PHP v...

CVE-2021-24370

The CVE-2021-24370 issue affects the WordPress plugin Fancy Product Designer prior to version 4.6.9 . It allows unauthenticated arbitrary file upload , which can lead to remote code execution on the server. Multiple connected documents corroborate an arbitrary-file-upload path and RCE vector, wit...

CVE-2021-30551

CVE-2021-30551 is a type confusion vulnerability in the V8 engine of Chromium-based browsers (e.g., Google Chrome/Chromium) prior to 91.0.4472.101. A remote attacker could potentially trigger heap corruption via a crafted HTML page. Multiple connected advisories confirm the issue and indicate aff...

CVE-2021-31618

CVE-2021-31618 affects the Apache httpd mod_http2 component. The issue is a NULL pointer dereference in the HTTP/2 header handling when size limits are violated, leading to denial of service by crashing the httpd worker process. Affected releases include mod_http2 1.15.17 and Apache httpd 2.4.47 ...

Command Execution Vulnerability in WIFISKY Layer 7 Flow Control Routers

Shenzhen Airspace Technology Co., Ltd "Airspace Technology" is a global network communication equipment supplier with its roots in Shenzhen. A command execution vulnerability exists in the WIFISKY 7-layer flow control router. An attacker can exploit this vulnerability to gain control of the serve...

CVE-2021-22175

GitLab’s SSRF vulnerability (CVE-2021-22175) affects GitLab CE/EE 10.5 and later when internal-network webhook requests are enabled. An unauthenticated attacker could trigger arbitrary internal requests via crafted webhook calls. The connected sources (Nuclei templates and Nessus/NASL entries) co...

CVE-2021-25395

CVE-2021-25395 describes a race condition in Samsung MFC charger driver prior to SMR MAY-2021 Release 1 that allows a local attacker with compromised radio privileges to bypass signature checks, impacting confidentiality, integrity, and availability. The vulnerability affects Samsung mobile devic...

CVE-2021-25394

CVE-2021-25394 is a race-condition-based use-after-free vulnerability in Samsung Mobile Devices’ MFC charger driver, prior to SMR MAY-2021 Release 1. The issue enables arbitrary writes after a radio privilege is compromised, with local attack vector and partial integrity/availability impact per C...

CVE-2021-26828

CVE-2021-26828 affects ScadaBR/OpenPLC ScadaBR up to 0.9.1 (Linux) and 1.12.4 (Windows). The flaw allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm, i.e., unrestricted file upload leading to remote code execution. Exploitation status varies across sour...

CVE-2021-26829

OpenPLC ScadaBR is vulnerable to a stored cross-site scripting (XSS) flaw via system_settings.shtm in Linux 0.9.1 and Windows 1.12.4. Root cause: input reflected/stored in the page enabling script execution in a user’s browser. Affected products/versions include OpenPLC ScadaBR prior to a newer r...