xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from...
Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users...
Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Platform Interface") protocol to communicate with the Collabora Editor, the communication between these two services was not...
In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193. Date published : 2021-07-27 https://www.drupal.org/sa-core-2021-004 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that...
An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1. To exploit, a re-INVITE without SDP must be received after Asterisk has sent a BYE request. Date published : 2021-07-27 http://seclists.org/fulldisclosure/2021/Jul/48...
isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository. Date published : 2021-07-27 https://github.com/isomorphic-git/isomorphic-git/pull/1339 https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.8.2
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir. Date published : 2021-07-27 https://security.netapp.com/advisory/ntap-20210902-0004/ https://hackerone.com/reports/1131465
The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker’s perimeter) via an account with write permissions. This occurs because...
OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use of CRC32. Date published : 2021-07-27 http://seclists.org/fulldisclosure/2021/Jul/37 http://packetstormsecurity.com/files/163569/OX-Documents-7.10.5-Improper-Authorization.html
OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32. Date published : 2021-07-27 http://seclists.org/fulldisclosure/2021/Jul/37 http://packetstormsecurity.com/files/163569/OX-Documents-7.10.5-Improper-Authorization.html
OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32. Date published : 2021-07-27 http://seclists.org/fulldisclosure/2021/Jul/37 http://packetstormsecurity.com/files/163569/OX-Documents-7.10.5-Improper-Authorization.html
Open redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version...
Server-side request forgery (SSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to...