‼ CVE-2021-38604 ‼
📖 Read
via "National Vulnerability Database".
In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32809 ‼
📖 Read
via "National Vulnerability Database".
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38599 ‼
📖 Read
via "National Vulnerability Database".
WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18446 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the param parameter in the insertContent function in ContentModel.php.📖 Read
via "National Vulnerability Database".
❌ Black Hat: Novel DNS Hack Spills Confidential Corp Data ❌
📖 Read
via "Threat Post".
Threatpost interviews Wiz CTO about a vulnerability recently patched by Amazon Route53's DNS service and Google Cloud DNS.📖 Read
via "Threat Post".
Threat Post
Black Hat: Novel DNS Hack Spills Confidential Corp Data
Threatpost interviews Wiz CTO about a vulnerability recently patched by Amazon Route53's DNS service and Google Cloud DNS.
‼ CVE-2021-34534 ‼
📖 Read
via "National Vulnerability Database".
Windows MSHTML Platform Remote Code Execution Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36938 ‼
📖 Read
via "National Vulnerability Database".
Windows Cryptographic Primitives Library Information Disclosure Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36949 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37640 ‼
📖 Read
via "National Vulnerability Database".
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L176-L181) calls the reshaping functor whenever there is at least an index in the input but does not check that shape of the input or the target shape have both a non-zero number of elements. The [reshape functor](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L40-L78) blindly divides by the dimensions of the target shape. Hence, if this is not checked, code will result in a division by 0. We have patched the issue in GitHub commit 4923de56ec94fff7770df259ab7f2288a74feb41. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1 as this is the other affected version.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36948 ‼
📖 Read
via "National Vulnerability Database".
Windows Update Medic Service Elevation of Privilege Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18458 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Request Forgery (CSRF) vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26424 ‼
📖 Read
via "National Vulnerability Database".
Windows TCP/IP Remote Code Execution Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33762 ‼
📖 Read
via "National Vulnerability Database".
Azure CycleCloud Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-36943.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26430 ‼
📖 Read
via "National Vulnerability Database".
Azure Sphere Denial of Service Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37636 ‼
📖 Read
via "National Vulnerability Database".
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825ffaba7a670d7747/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L56) uses a common class for all binary operations but fails to treat the division by 0 case separately. We have patched the issue in GitHub commit d9204be9f49520cdaaeb2541d1dc5187b23f31d9. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36946 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18451 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability exists in DamiCMS v6.0.6 via the title parameter in the doadd function in LabelAction.class.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36932 ‼
📖 Read
via "National Vulnerability Database".
Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-26433, CVE-2021-36926, CVE-2021-36933.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36941 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Word Remote Code Execution Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18460 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Request Forgery (CSRF) vulnerability exists in 711cms v1.0.7 that can add an admin account via admin.php?c=Admin&m=content.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36943 ‼
📖 Read
via "National Vulnerability Database".
Azure CycleCloud Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33762.📖 Read
via "National Vulnerability Database".