‼ CVE-2021-36535 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37501 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools/lib/h5tools_str.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37379 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** Cross Site Scripting (XSS) vulnerability in Teradek Sphere all firmware versions allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37305 ‼
📖 Read
via "National Vulnerability Database".
An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37316 ‼
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to view sensitive information via /etc/shadow.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37375 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** Cross Site Scripting (XSS) vulnerability in Teradek VidiU / VidiU Mini firmware version 3.0.8 and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36493 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23087 ‼
📖 Read
via "National Vulnerability Database".
An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36570 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36424 ‼
📖 Read
via "National Vulnerability Database".
An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23088 ‼
📖 Read
via "National Vulnerability Database".
Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via the json_value_parse function.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36443 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36545 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyright or cfg_tel field in Site Configuration page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37317 ‼
📖 Read
via "National Vulnerability Database".
Directory Traversal vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the target for COPY and MOVE operations.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36538 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36546 ‼
📖 Read
via "National Vulnerability Database".
Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36484 ‼
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0659 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in BDCOM 1704-WGL 2.0.6314. It has been classified as critical. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-220101 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
🕴 What CISOs Can Do About Brand Impersonation Scam Sites 🕴
📖 Read
via "Dark Reading".
Apply these 9 tips to proactively fight fraudulent websites that steal customers' trust, money, and personally identifiable information.📖 Read
via "Dark Reading".
Dark Reading
What CISOs Can Do About Brand Impersonation Scam Sites
Apply these nine tips to proactively fight fraudulent websites that use your brand to rip people off.
‼ CVE-2022-31733 ‼
📖 Read
via "National Vulnerability Database".
Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND unproxied ports are turned off, then an attacker could connect to an application that should be only reachable via mTLS, without presenting a client certificate.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23940 ‼
📖 Read
via "National Vulnerability Database".
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.📖 Read
via "National Vulnerability Database".