CVE漏洞

OGeek|极客世界-中国程序员成长平台 › 门户 › 漏洞›CVE漏洞

RSS

CVE-2021-37966

Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：9 | 回复：0
CVE-2021-37967

Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted H ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：16 | 回复：0
CVE-2021-37968

Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：14 | 回复：0
CVE-2021-37969

Inappropriate implementation in Google Updater in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to perform local privilege escalation via a crafted file.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：19 | 回复：0
CVE-2021-37970

Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：19 | 回复：0
CVE-2021-37971

Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：20 | 回复：0
CVE-2021-37972

Out of bounds read in libjpeg-turbo in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：26 | 回复：0
CVE-2021-37973

Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：27 | 回复：0
CVE-2021-37974

Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：18 | 回复：0
CVE-2021-37975

Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：20 | 回复：0
CVE-2021-37976

Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：17 | 回复：0
CVE-2021-25966

In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password has been changed by the user or by an a ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：17 | 回复：0
CVE-2021-42134

The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：19 | 回复：0
CVE-2021-41055

Gajim 1.2.x and 1.3.x before 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted XMPP Last Message Correction (XEP-0308) message in multi-user chat, where the message ID e ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：16 | 回复：0
CVE-2021-42135

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：17 | 回复：0
CVE-2021-42137

An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：77 | 回复：0
CVE-2021-42139

Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：76 | 回复：0
CVE-2021-41798

MediaWiki before 1.36.2 allows XSS. Month related MediaWiki messages are not escaped before being used on the Special:Search results page.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：14 | 回复：0
CVE-2021-41799

MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). ApiQueryBacklinks (action=querylist=backlinks) can cause a full table scan.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：21 | 回复：0
CVE-2021-41800

MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query beca ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：8 | 回复：0
CVE-2021-41801

The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (d ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：12 | 回复：0
CVE-2021-41830

It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to upda ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：10 | 回复：0
CVE-2021-41831

It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021 ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：27 | 回复：0
CVE-2021-41832

It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4 ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：15 | 回复：0
CVE-2021-35059

OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：17 | 回复：0
CVE-2021-35060

/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：24 | 回复：0
CVE-2021-40889

CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in {webroot}/uno/central.php file calls to file_put_contents() function to write username in password.php file ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：18 | 回复：0
CVE-2021-24545

The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：23 | 回复：0
CVE-2021-24546

The Gutenberg Block Editor Toolkit â€“ EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role a ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：6 | 回复：0
CVE-2021-24563

The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript f ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：9 | 回复：0
CVE-2021-24576

The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：12 | 回复：0
CVE-2021-24577

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode p ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：14 | 回复：0
CVE-2021-24651

The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possibl ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：25 | 回复：0
CVE-2021-24656

The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allow ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：17 | 回复：0
CVE-2021-24681

The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Si ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：22 | 回复：0
CVE-2021-24683

The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting is ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：24 | 回复：0
CVE-2021-24690

The Chained Quiz WordPress plugin before 1.2.7.2 does not properly sanitize or escape inputs in the plugin's settings.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：19 | 回复：0
CVE-2021-24691

The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scri ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：14 | 回复：0
CVE-2021-24709

The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf, *_speed) which could lead to Stored Cross-Site Scripting i ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：35 | 回复：0
CVE-2021-24711

The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF attack……

作者：菜鸟教程小白 | 时间：2022-2-5 12:10 | 阅读：24 | 回复：0