‼ CVE-2021-39195 ‼
📖 Read
via "National Vulnerability Database".
Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been fixed in 12.90.0. However, if you are using a proxy, you will need to take additional measures. As a workaround this exploit may be avoided by appropriately restricting access to private networks from the host where the application is running.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35947 ‼
📖 Read
via "National Vulnerability Database".
The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39196 ‼
📖 Read
via "National Vulnerability Database".
pcapture is an open source dumpcap web service interface . In affected versions this vulnerability allows an authenticated but unprivileged user to use the REST API to capture and download packets with no capture filter and without adequate permissions. This is important because the capture filters can effectively limit the scope of information that a user can see in the data captures. If no filter is present, then all data on the local network segment where the program is running can be captured and downloaded. v3.12 fixes this problem. There is no workaround, you must upgrade to v3.12 or greater.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39199 ‼
📖 Read
via "National Vulnerability Database".
remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitrary HTML can be passed through leading to potential XSS attacks. The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default, and the implementation matches the documentation. On older affected versions, pass `sanitize: true` if you cannot update.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35949 ‼
📖 Read
via "National Vulnerability Database".
The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share.📖 Read
via "National Vulnerability Database".
❌ Netgear Smart Switches Open to Complete Takeover ❌
📖 Read
via "Threat Post".
The Demon's Cries, Draconian Fear and Seventh Inferno security bugs are high-severity entryways to corporate networks.📖 Read
via "Threat Post".
Threat Post
Netgear Smart Switches Open to Complete Takeover
The Demon's Cries, Draconian Fear and Seventh Inferno security bugs are high-severity entryways to corporate networks.
‼ CVE-2021-37629 ‼
📖 Read
via "National Vulnerability Database".
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended that the Nextcloud Richdocuments app is upgraded to either 3.8.4 or 4.2.1 to resolve. For users unable to upgrade it is recommended that the Richdocuments application be disabled.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39499 ‼
📖 Read
via "National Vulnerability Database".
A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` parameter in bind_email function.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39496 ‼
📖 Read
via "National Vulnerability Database".
Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35946 ‼
📖 Read
via "National Vulnerability Database".
A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32766 ‼
📖 Read
via "National Vulnerability Database".
Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link share has been created with "Upload Only" privileges. (aka "File Drop"). A link share recipient is not expected to see which folders or files exist in a "File Drop" share. Using this vulnerability an attacker is able to enumerate folders in such a share. Exploitation requires that the attacker has access to a valid affected "File Drop" link share. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.0.1. Users who are unable to upgrade are advised to disable the Nextcloud Text application in the app settings.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-19752 ‼
📖 Read
via "National Vulnerability Database".
The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38706 ‼
📖 Read
via "National Vulnerability Database".
messages_load.php in ClinicCases 7.3.3 suffers from a blind SQL injection vulnerability, which allows low-privileged attackers to execute arbitrary SQL commands through a vulnerable parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38707 ‼
📖 Read
via "National Vulnerability Database".
Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session token theft.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39503 ‼
📖 Read
via "National Vulnerability Database".
PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without "<, >, ?, =, `,...." In WriteConfig() function, an attacker can inject php code to /include/config.cache.php file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35948 ‼
📖 Read
via "National Vulnerability Database".
Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-19751 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in gpac 0.8.0. The gf_odf_del_ipmp_tool function in odf_code.c has a heap-based buffer over-read.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37631 ‼
📖 Read
via "National Vulnerability Database".
Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't properly check membership of users in a Circle. This allowed other users in the instance to gain access to boards that have been shared with a Circle, even if the user was not a member of the circle. It is recommended that Nextcloud Deck is upgraded to 1.5.1, 1.4.4 or 1.2.9. If you are unable to update it is advised to disable the Deck plugin.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37630 ‼
📖 Read
via "National Vulnerability Database".
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is recommended that Nextcloud Circles is upgraded to 0.19.15, 0.20.11 or 0.21.4. There are no workarounds for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32782 ‼
📖 Read
via "National Vulnerability Database".
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37628 ‼
📖 Read
via "National Vulnerability Database".
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features ("Upload Only" public link shares in Nextcloud) can be bypassed using the Nextcloud Richdocuments app. An attacker was able to read arbitrary files in such a share. It is recommended that the Nextcloud Richdocuments is upgraded to 3.8.4 or 4.2.1. If upgrading is not possible then it is recommended to disable the Richdocuments application.📖 Read
via "National Vulnerability Database".