types Archives
Advisory
26/07/2021 CVE-2021-37859 medium
![[Advisory]](https://www.shielder.com//img/advisory.png)
The OAuth flow implemented in Mattermost server v5.32 > v5.36 is affected by a reflected XSS. An unauthenticated attacker might gain access to the victim's session.
A privileged user can obtain remote code execution on Q'center through a manipulated QPKG installation package.
An unauthenticated attacker can inject JavaScript code on Q'center Virtual Appliance event log page.
19/05/2021 CVE-2020-36197 CVE-2020-36198 high
QNAP MusicStation and MalwareRemover pre-installed official apps are affected by an arbitrary file upload and a command injection, leading to pre-auth remote root command execution.
12/04/2021 CVE-2021-31316 CVE-2021-31324 critical
The unprivileged user portal part of CentOS Web Panel is affected by SQL Injection and Command Injection vulnerabilities, leading to root Remote Code Execution.
16/02/2021 CVE-2021-31318 medium
Telegram rlottie 6.1.1_1946 is affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function: a remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device.
16/02/2021 CVE-2021-31322 medium
Telegram rlottie 6.1.1_1946 is affected by a Heap Buffer Overflow in the LOTGradient::populate function: a remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device.
16/02/2021 CVE-2021-31320 high
Telegram rlottie 6.1.1_1946 is affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function: a remote attacker might be able to overwrite Telegram's heap memory out-of-bounds on a victim device.
Telegram rlottie 7.0.1_2065 is affected by a Stack Based Overflow in the blit function: a remote attacker might be able to access Telegram's stack memory out-of-bounds on a victim device.
16/02/2021 CVE-2021-31321 high
Telegram rlottie 7.0.1_2065 is affected by a Stack Based Overflow in the gray_split_cubic function: a remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device.