CVE漏洞

OGeek|极客世界-中国程序员成长平台 › 门户 › 漏洞›CVE漏洞

RSS

CVE-2021-30675

A memory corruption issue was addressed with improved state management. This issue is fixed in Boot Camp 6.1.14. A malicious application may be able to elevate privileges.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:40 | 阅读：40 | 回复：0
CVE-2021-30676

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A local user may be able to c ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:40 | 阅读：46 | 回复：0
CVE-2021-30677

This issue was addressed with improved environment sanitization. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave, macOS B ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:40 | 阅读：46 | 回复：0
CVE-2021-30678

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A remote attacker may be able ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:40 | 阅读：47 | 回复：0
CVE-2021-30679

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. An application may be able to g ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:40 | 阅读：30 | 回复：0
CVE-2021-30680

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4. A local user may be able to load unsigned kernel extensions.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:40 | 阅读：37 | 回复：0
CVE-2021-30681

A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:40 | 阅读：32 | 回复：0
CVE-2021-30682

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:40 | 阅读：47 | 回复：0
CVE-2021-3766

objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：30 | 回复：0
CVE-2021-3767

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：18 | 回复：0
CVE-2021-3768

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：34 | 回复：0
CVE-2021-3770

vim is vulnerable to Heap-based Buffer Overflow……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：17 | 回复：0
CVE-2021-36093

It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later v ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：15 | 回复：0
CVE-2021-36094

It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTR ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：33 | 回复：0
CVE-2021-36095

Malicious attacker is able to find out valid user logins by using the lost password feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：30 | 回复：0
CVE-2021-36096

Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS A ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：17 | 回复：0
CVE-2020-15939

An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the device configuration f ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：31 | 回复：0
CVE-2021-24006

An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：18 | 回复：0
CVE-2021-40528

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：24 | 回复：0
CVE-2021-40529

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dang ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：30 | 回复：0
CVE-2021-40530

The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by th ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：18 | 回复：0
CVE-2021-40531

Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote c ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：18 | 回复：0
CVE-2021-40532

Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：17 | 回复：0
CVE-2021-40540

ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info-request NULL check for certain malformed HTTP requests.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：22 | 回复：0
CVE-2021-33483

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when use ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：23 | 回复：0
CVE-2021-33484

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：19 | 回复：0
CVE-2021-28135

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：22 | 回复：0
CVE-2021-28136

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing atta ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：28 | 回复：0
CVE-2021-28155

The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of s ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：23 | 回复：0
CVE-2021-31613

The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP packet during the LMP auto rate procedure, allowing attackers i ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：23 | 回复：0
CVE-2021-33831

api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control. An attacker can interfere with tracing of infection chains by creating 500 r ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：16 | 回复：0
CVE-2021-34144

The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LMP_SCO_Link_Request packets while no other BT connections are ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：26 | 回复：0
CVE-2021-34150

The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of oversized DM1 LMP packets while no other BT connections are ac ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：28 | 回复：0
CVE-2021-38840

SQL Injection can occur in Simple Water Refilling Station Management System 1.0 via the water_refilling/classes/Login.php username parameter.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：17 | 回复：0
CVE-2021-38841

Remote Code Execution can occur in Simple Water Refilling Station Management System 1.0 via the System Logo option on the system_info page in classes/SystemSettings.php with an update_settings action.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：13 | 回复：0
CVE-2021-39278

Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：21 | 回复：0
CVE-2021-39279

Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：23 | 回复：0
CVE-2021-28139

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in r ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：21 | 回复：0
CVE-2021-31609

The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bytes, allowing attackers in radio range ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：18 | 回复：0
CVE-2021-31610

The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：19 | 回复：0