‼ CVE-2021-34823 ‼
📖 Read
via "National Vulnerability Database".
The ON24 ScreenShare (aka DesktopScreenShare.app) plugin before 2.0 for macOS allows remote file access via its built-in HTTP server. This allows unauthenticated remote users to retrieve files accessible to the logged-on macOS user. When a remote user sends a crafted HTTP request to the server, it triggers a code path that will download a configuration file from a specified remote machine over HTTP. There is an XXE flaw in processing of this configuration file that allows reading local (to macOS) files and uploading them to remote machines.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32071 ‼
📖 Read
via "National Vulnerability Database".
The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control. A successful exploit could allow an attacker to view and modify application data, and cause a denial of service for users.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36793 ‼
📖 Read
via "National Vulnerability Database".
The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37028 ‼
📖 Read
via "National Vulnerability Database".
There is a command injection vulnerability in the HG8045Q product. When the command-line interface is enabled, which is disabled by default, attackers with administrator privilege could execute part of commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36785 ‼
📖 Read
via "National Vulnerability Database".
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32068 ‼
📖 Read
via "National Vulnerability Database".
The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation requests, due to insufficient TLS session controls. A successful exploit could allow an attacker to modify application data and state.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36792 ‼
📖 Read
via "National Vulnerability Database".
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38302 ‼
📖 Read
via "National Vulnerability Database".
The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38554 ‼
📖 Read
via "National Vulnerability Database".
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18759 ‼
📖 Read
via "National Vulnerability Database".
An information disclosure vulnerability exists in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32069 ‼
📖 Read
via "National Vulnerability Database".
The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18757 ‼
📖 Read
via "National Vulnerability Database".
An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to cause persistent denial of service (DOS) via a crafted packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36790 ‼
📖 Read
via "National Vulnerability Database".
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36788 ‼
📖 Read
via "National Vulnerability Database".
The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36791 ‼
📖 Read
via "National Vulnerability Database".
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37586 ‼
📖 Read
via "National Vulnerability Database".
The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user (with Administrator rights) to replay a previously recorded conversation of another tenant due to insufficient validation.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18753 ‼
📖 Read
via "National Vulnerability Database".
An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to gain access to the system and escalate privileges via a crafted packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32067 ‼
📖 Read
via "National Vulnerability Database".
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output sanitization.📖 Read
via "National Vulnerability Database".
❌ Exchange Servers Under Active Attack via ProxyShell Bugs ❌
📖 Read
via "Threat Post".
There’s an entirely new attack surface in Exchange, a researcher revealed at Black Hat, and threat actors are now exploiting servers vulnerable to the RCE bugs.📖 Read
via "Threat Post".
Threat Post
Exchange Servers Under Active Attack via ProxyShell Bugs
There’s an entirely new attack surface in Exchange, a researcher revealed at Black Hat, and threat actors are now exploiting servers vulnerable to the RCE bugs.
‼ CVE-2021-21829 ‼
📖 Read
via "National Vulnerability Database".
A heap-based buffer overflow vulnerability exists in the XML Decompression EnumerationUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21830 ‼
📖 Read
via "National Vulnerability Database".
A heap-based buffer overflow vulnerability exists in the XML Decompression LabelDict::Load functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.📖 Read
via "National Vulnerability Database".