#microsoft

CVE-2021-41557: Software for automotive leasing, financing and mobility management

Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting (XSS). An attacker with access to a user account of the RIA IT or the Fleet role can create a crafted work order in the damage reports section (or change existing work orders). The XSS payload is in the work order number.

2 years ago

CVE

Open in Source

#xss #microsoft #git

RHSA-2021:5134: Red Hat Security Advisory: Red Hat Fuse 7.10.0 release and security update

A minor version update (from 7.9 to 7.10) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2019-10744: nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties * CVE-2019-12415: poi: a specially crafted Microsoft Excel document allows attacker to read files from the local filesystem * CVE-2020-2875: mysql-...

2 years ago

Red Hat Security Data

Open in Source

#sql #xss #vulnerability #web #microsoft #red_hat #ddos #dos #apache #nodejs #js #java #kubernetes

CVE-2021-41067: exploiting Listary: Searching your way to SYSTEM privileges

An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation of update packages that can cause an installation of malicious content.

3 years ago

CVE

Open in Source

#vulnerability #mac #windows #microsoft #js #git

Researcher Spotlight: Dr. Nestori Syynimaa’s Constant Mission Protecting Identities

“When you find the things I find, they really matter. They affect everybody’s security.” Currently streaming : The Expanse and Lost in Space on Netflix Currently listening to : Amorphis, Architects, and Killswitch Engage Currently running : 130 kilometers (or ~80 miles) a month Currently playing : Floorball (a type of floor hockey with five players and a goalkeeper)

3 years ago

msrc-blog

Open in Source

#vulnerability #ios #microsoft #git #c++

CVE-2021-4102: Chromium: CVE-2021-4102 Use after free in V8