๐จ CVE-2021-1111
Bootloader contains a vulnerability in the NV3P server where any user with physical access through USB can trigger an incorrect bounds check, which may lead to buffer overflow, resulting in limited information disclosure, limited data integrity, and denial of service across all components.
๐@cveNotify
Bootloader contains a vulnerability in the NV3P server where any user with physical access through USB can trigger an incorrect bounds check, which may lead to buffer overflow, resulting in limited information disclosure, limited data integrity, and denial of service across all components.
๐@cveNotify
๐จ CVE-2021-24831
All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.
๐@cveNotify
All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.
๐@cveNotify
WPScan
Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX Calls
See details on Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX Calls CVE 2021-24831. View the latest Plugin Vulnerabilities on WPScan.
๐จ CVE-2022-0268
Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.
๐@cveNotify
Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.
๐@cveNotify
GitHub
Fixed XSS check not detecting escaped `:` ยท getgrav/grav@6f2fa93
Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony - Fixed XSS check not detecting escaped `:` ยท getgrav/grav@6f2fa93
๐จ CVE-2021-45341
A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
๐@cveNotify
A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
๐@cveNotify
GitHub
Remote Code Execution vulnerability in LibreCAD 2.2.0-rc3 (JWW CDataMoji) ยท Issue #1462 ยท LibreCAD/LibreCAD
Vulnerable Products LibreCAD 2.2.0-rc3 and older Jw_cad 8.24a and older Steps to reproduce or sample file Start LibreCAD 2.2.0-rc3 in a debugger File/Open... Unzip and open the attached proof of co...
๐จ CVE-2021-45340
In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DOS) via a crafted PICT file.
๐@cveNotify
In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DOS) via a crafted PICT file.
๐@cveNotify
GitHub
NULL pointer dereference in stb_image.h ยท Issue #51 ยท libsixel/libsixel
This is a duplicate report of issue 160 in the original project. I'm not sure where best to report this, but it affects both projects. Vulnerable versions saitoha/libsixel at the latest (6a5be8...
๐จ CVE-2021-38783
There is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver "/dev/cedar_dev" through iotcl cmd IOCTL_SET_PROC_INFO and IOCTL_COPY_PROC_INFO, which could cause a system crash or EoP.
๐@cveNotify
There is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver "/dev/cedar_dev" through iotcl cmd IOCTL_SET_PROC_INFO and IOCTL_COPY_PROC_INFO, which could cause a system crash or EoP.
๐@cveNotify
Wangan
็ ๆตทๅ
จๅฟ็งๆ่กไปฝๆ้ๅ
ฌๅธR818ๅญๅจไบ่ฟๅถๆผๆด_CNVD-2021-49168-็ฝๅฎๆผๆดๅนณๅฐ
R818ๆฏไธๆฌพๅๆ ธๆบ่ฝๅธฆๅฑ่ฏญ้ณ่ฏ็ใ ็ ๆตทๅ
จๅฟ็งๆ่กไปฝๆ้ๅ
ฌๅธR818ๅญๅจไบ่ฟๅถๆผๆด๏ผๆปๅป่
ๅฏๅฉ็จ่ฏฅๆผๆด้ ๆๆ็ปๆๅกใ
๐จ CVE-2021-36294
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulnerability by forging a cookie to login as any user.
๐@cveNotify
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulnerability by forging a cookie to login as any user.
๐@cveNotify
๐จ CVE-2021-36289
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read sensitive information and use it.
๐@cveNotify
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read sensitive information and use it.
๐@cveNotify
๐จ CVE-2021-36348
iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to iDRAC.
๐@cveNotify
iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to iDRAC.
๐@cveNotify
Dell
DSA-2021-259: Dell EMC iDRAC Security Update for Multiple Security Vulnerabilities | Dell UK
Dell EMC iDRAC remediation is available for multiple security vulnerabilities that may be exploited by malicious users to compromise the affected system.
๐จ CVE-2021-36347
iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability. An authenticated remote attacker with high privileges could potentially exploit this vulnerability to control process execution and gain access to the iDRAC operating system.
๐@cveNotify
iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability. An authenticated remote attacker with high privileges could potentially exploit this vulnerability to control process execution and gain access to the iDRAC operating system.
๐@cveNotify
Dell
DSA-2021-259: Dell EMC iDRAC Security Update for Multiple Security Vulnerabilities | Dell UK
Dell EMC iDRAC remediation is available for multiple security vulnerabilities that may be exploited by malicious users to compromise the affected system.
๐จ CVE-2021-36346
Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to deny access to the iDRAC webserver.
๐@cveNotify
Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to deny access to the iDRAC webserver.
๐@cveNotify
Dell
DSA-2021-259: Dell EMC iDRAC Security Update for Multiple Security Vulnerabilities | Dell UK
Dell EMC iDRAC remediation is available for multiple security vulnerabilities that may be exploited by malicious users to compromise the affected system.
๐จ CVE-2021-36296
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges may exploit this vulnerability to execute commands on the system.
๐@cveNotify
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges may exploit this vulnerability to execute commands on the system.
๐@cveNotify
๐จ CVE-2021-36295
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges may exploit this vulnerability to execute commands on the system.
๐@cveNotify
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges may exploit this vulnerability to execute commands on the system.
๐@cveNotify
๐จ CVE-2022-21392
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager Base Platform accessible data as well as unauthorized update, insert or delete access to some of Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 8.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
๐@cveNotify
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager Base Platform accessible data as well as unauthorized update, insert or delete access to some of Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 8.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
๐@cveNotify
๐จ CVE-2021-26708
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support.
๐@cveNotify
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support.
๐@cveNotify
๐จ CVE-2022-23968
Xerox VersaLink devices through 2022-01-24 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot, but image parsing is restarted as soon as the boot process finishes. However, this boot loop can be resolved by a field technician. The TIFF file must have an incomplete Image Directory. Affected firmware versions include xx.42.01 and xx.50.61.
๐@cveNotify
Xerox VersaLink devices through 2022-01-24 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot, but image parsing is restarted as soon as the boot process finishes. However, this boot loop can be resolved by a field technician. The TIFF file must have an incomplete Image Directory. Affected firmware versions include xx.42.01 and xx.50.61.
๐@cveNotify
The NeoSmart Files
CVE-2022-23968: Xerox vulnerability allows unauthenticated users to remotely brick network printers (UPDATED)
In the world of network security, it pays to always remember that many (if not most!) security bugs start off their lives as seemingly innocuous โregularโ bugs, and itโs only by dโฆ
๐จ CVE-2022-0375
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
๐@cveNotify
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
๐@cveNotify
GitHub
fx #1734 ยท LiveHelperChat/livehelperchat@bbfaa26
Live Helper Chat - live support for your website. Featuring web and mobile apps, Voice & Video & ScreenShare. Supports Telegram, Twilio (whatsapp), Facebook messenger including building a bot. - fx #1734 ยท LiveHelperChat/livehelperchat@bbfaa26
๐จ CVE-2022-0374
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
๐@cveNotify
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
๐@cveNotify
huntr.dev
Cross-site Scripting (XSS) - Stored in livehelperchat
1.51K developers have been protected by securing livehelperchat. Read this report, and explore others to learn how you can also protect the world by earning cash and CVEs.
๐จ CVE-2022-21944
A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.
๐@cveNotify
A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.
๐@cveNotify
๐จ CVE-2021-30952
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
๐@cveNotify
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
๐@cveNotify
Apple Support
About the security content of watchOS 8.3
This document describes the security content of watchOS 8.3.