CVE-2021-20617

CVE-2021-20617 concerns Acmailer and Acmailer DB with an improper access control flaw that allows remote attackers to execute arbitrary OS commands or escalate privileges (CWE-284). Affected versions are Acmailer 4.0.1 and earlier and Acmailer DB 1.1.3 and earlier; the issue enables command execu...

CVE-2020-35687

CVE-2020-35687 affects PHPFusion CMS 9.03.90. A CSRF vulnerability in the shoutbox management allows an attacker to delete all shoutbox messages on behalf of a logged-in victim. Public PoCs/exploits exist (e.g., PacketStorm, Exploit-DB) showing a GET request triggering deletion via shoutbox_archi...

CVE-2021-1647

CVE-2021-1647 is a Microsoft Defender Remote Code Execution vulnerability. Multiple sources indicate it was exploited in the wild before patches were available, affecting Microsoft Defender/Windows Defender. The advisory notes a remote code execution risk; exploitation could allow an attacker to ...

CVE-2021-1648

CVE-2021-1648 is a Windows splwow64 Elevation of Privilege vulnerability. The affected component is splwow64 (Printer subsystem interaction with 32-bit print path). The CVE is publicly documented with a high-severity CVSS, reflecting local access and privilege escalation potential. The connected ...

CVE-2021-1636

Technical details about CVE-2021-1636 are not publicly provided in the supplied documents. Please monitor for updates from official sources for affected products, vulnerable components, impact, and remediation.

CVE-2021-3129

CVE-2021-3129 affects Laravel Ignition (and Laravel < 8.4.2) where insecure use of file_get_contents()/file_put_contents in debug mode allows unauthenticated RCE. Exploitable versions: Laravel Ignition < 2.5.2 and Laravel

CVE-2020-16040

CVE-2020-16040 affects Google Chrome/Chromium before 87.0.4280.88 due to insufficient data validation in V8 , which could allow a remote attacker to trigger heap corruption and potentially execute arbitrary code. The vulnerability is mitigated by upgrading to 87.0.4280.88 (fixed upstream; Debian/...

CVE-2020-16027

CVE-2020-16027 affects Chromium/Google Chrome before 87.0.4280.66, specifically the developer tools component where insufficient policy enforcement allowed an attacker to cause information disclosure via a crafted extension. Affected product: Chromium/Chrome; root cause: access restriction bypass...

CVE-2020-16017

CVE-2020-16017 is a use-after-free vulnerability in site isolation of Chromium-based browsers (Google Chrome/Chromium) before version 86.0.4240.198. The underlying issue in the renderer process could enable a remote attacker to escape the sandbox via a crafted HTML page, as described in multiple ...

CVE-2020-16013

CVE-2020-16013 concerns the Chromium V8 engine used by Google Chrome prior to 86.0.4240.198, where an inappropriate implementation could allow a remote attacker to trigger heap corruption via a crafted HTML page. Affected software is Chromium-based Chrome builds up to version 86.0.4240.198 (inclu...

CVE-2020-35131

Affected software: Cockpit CMS pre-0.6.1. The vulnerability is a code execution flaw caused by insecure handling of registerCriteriaFunction in lib/MongoLite/Database.php, enabling an attacker to inject PHP through crafted JSON values to /auth/check or /auth/requestreset. Impact is remote, unauth...

File upload vulnerability in Zhiyuan OA system (CNVD-2021-01627)

Zhiyuan OA is a collaborative management software, a digital collaborative operation platform for medium-sized and large group organizations. A file upload vulnerability exists in Zhiyuan OA system. The vulnerability is due to the existence of unauthorized access vulnerability in some interfaces,...

CVE-2021-21234

CVE-2021-21234 affects the Spring Boot Actuator Logview library (eu.hinsch:spring-boot-actuator-logview). Before version 0.2.13, there is a directory traversal vulnerability exposed by the actuator logviewer endpoint, where both the filename parameter and the base directory can be manipulated (ba...

CVE-2020-17519

CVE-2020-17519 is an Apache Flink directory traversal vulnerability that permits reading arbitrary files on the JobManager host via the REST interface. The flaw stems from a change introduced in Flink 1.11.0 (affecting 1.11.0, 1.11.1, and 1.11.2) and is limited to files accessible by the JobManag...

CVE-2020-17518

CVE-2020-17518 affects Apache Flink 1.5.1. A REST file upload handler allowed an attacker to write a file to an arbitrary location on the local filesystem by manipulating the HTTP header (directory-traversal via file upload). The issue is mitigated by upgrading Flink to 1.11.3 or 1.12.0 (where th...

CVE-2020-36112

CVE-2020-36112 affects CSE Bookstore 1.0. The vulnerability is an SQL injection (time-based blind, boolean-based blind, and OR-based) in the pubid parameter of bookPerPub.php and cart.php, allowing an attacker to dump the entire database. Affected software: CSE Bookstore 1.0. Root cause: improper...

CVE-2021-3007

Laminas-http

CVE-2020-10148

CVE-2020-10148 is a vulnerability in the SolarWinds Orion API where an authentication bypass can allow a remote attacker to execute API commands, potentially compromising the Orion instance. Affected are SolarWinds Orion Platform versions 2019.4 HF5, 2020.2 with no hotfix, and 2020.2 HF1. The vul...

CVE-2020-35730

Roundcube Webmail contains a cross-site scripting (XSS) vulnerability in rcube_string_replacer.php (linkref_addindex). An attacker can embed JavaScript in a plain-text email link reference, leading to script execution in the victim’s browser. Affected: Roundcube <1.2.13, <1.3.16 for 1.3.x, ...

CVE-2020-35713

Belkin Linksys RE6500 devices running firmware older than 1.0.012.001 are vulnerable to remote code execution through shell metacharacters submitted to the goform/setSysAdm page. The provided documents describe an unauthenticated or remote attacker capable of executing arbitrary commands or setti...