#threatintel #security #osint Archives

CVE-2021-43861

December 30, 2021 admin #threatintel #security #osint, CVE, CVE-2021-43861, MISC, vulnerability

Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers’ machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.

Vulnerabilities

CVE-2021-43854

December 27, 2021 admin #threatintel #security #osint, CVE, CVE-2021-43854, MISC, vulnerability

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Versions prior to 3.6.5 are vulnerable to regular expression denial of service (ReDoS) attacks. The vulnerability is present in PunktSentenceTokenizer, sent_tokenize and word_tokenize. Any users of this class, or these two functions, are vulnerable to the ReDoS attack. In short, a specifically crafted long input to any of these vulnerable functions will cause them to take a significant amount of execution time. If your program relies on any of the vulnerable functions for tokenizing unpredictable user input, then we would strongly recommend upgrading to a version of NLTK without the vulnerability. For users unable to upgrade the execution time can be bounded by limiting the maximum length of an input to any of the vulnerable functions. Our recommendation is to implement such a limit.

Vulnerabilities

CVE-2021-43853

December 23, 2021 admin #threatintel #security #osint, CONFIRM, CVE, CVE-2021-43853, vulnerability

Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details.

Vulnerabilities

CVE-2020-9759

September 30, 2021 admin #threatintel #security #osint, CONFIRM, CVE, CVE-2020-9759, vulnerability

A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable files.

Vulnerabilities

CVE-2015-7236

July 7, 2021 admin #threatintel #security #osint, CVE, CVE-2015-7236, debian, vulnerability

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

Vulnerabilities

CVE-2019-6836

April 17, 2021 admin #threatintel #security #osint, CVE, CVE-2019-6836, MISC, vulnerability

A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 – U.motion KNX server, MEG6501-0002 – U.motion KNX Server Plus, MEG6260-0410 – U.motion KNX Server Plus, Touch 10, MEG6260-0415 – U.motion KNX Server Plus, Touch 15), which could allow the file system to access the wrong file.