CVE-2021-33701

CVE-2021-33701 affects SAP NetWeaver/DMIS components (e.g., SAP DMIS 2011_1_731 SP0013) via a remote SQL injection in the NDZT tool used by S/4HANA and the DMIS mobile plug-in. The root cause is an injection in the IUUC_RECON_RC_COUNT_TABLE_BIG/related query surface, enabling an attacker with hig...

CVE-2021-33701

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 20111620, 20111640, 20111700, 20111710, 20111730, 710, 20111731, 710, 20111752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain...

CVE-2020-19158

Cross Site Scripting XSS in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin//app/config/'...

CVE-2020-19158

Cross Site Scripting XSS in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin//app/config/'...

Cross site scripting

Cross Site Scripting XSS in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin//app/config/'...

CVE-2020-19158

CVE-2020-19158 affects S-CMS (build 20191014 and earlier). The vulnerability is a Cross Site Scripting (XSS) in the Site Title parameter of the component /data/admin/#/app/config/, allowing remote attackers to execute arbitrary code. No remediation details are provided in the connected documents.

CVE-2020-19158

Cross Site Scripting XSS in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin//app/config/'...

PT-2021-10298

Name of the Vulnerable Software and Affected Versions: S-CMS versions 20191014 and earlier Description: The issue allows remote attackers to execute arbitrary code via the Site Title parameter of the component "/data/admin//app/config/". This enables attackers to perform Cross Site Scripting XSS...

CVE-2020-19158: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin//app/config/'...

CVE-2021-33701: Improper Neutralization of Special Elements used in an SQL Command

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 20111620, 20111640, 20111700, 20111710, 20111730, 710, 20111731, 710, 20111752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain...

Security Updates for Microsoft SharePoint Server 2013 (September 2021)

The Microsoft SharePoint Server 2013 installation on the remote host is missing security updates. It is, therefore, affected by multiple Server Spoofing Vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

Cisco IOS XR Software for 8000 Network Convergence System 540 Series Routers Image Verification (cisco-sa-lnt-QN9mCzwn)

According to its self-reported version, Cisco IOS XR is affected by multiple vulnerabilities in image verification checks that enables an authenticated, local attacker to execute arbitrary code on the underlying operating system. Note that Nessus has not tested for this issue but has instead reli...

PT-2021-10312

Name of the Vulnerable Software and Affected Versions: MipCMS version 5.0.1 Description: A cross-site request forgery CSRF issue allows attackers to escalate user privileges to administrator. This can be achieved via the "index.php?s=/user/ApiAdminUser/itemEdit" endpoint, by exploiting the lack o...

PT-2021-10313

Name of the Vulnerable Software and Affected Versions: MipCMS version 5.0.1 Description: A cross-site request forgery CSRF issue allows attackers to arbitrarily add users via the "index.php?s=/user/ApiAdminUser/itemAdd" API endpoint. This enables unauthorized access to add new users...

CVE-2020-19263: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF in MipCMS v5.0.1 allows attackers to arbitrarily escalate user privileges to administrator via index.php?s=/user/ApiAdminUser/itemEdit...

OTRS Information Disclosure Vulnerability (CNVD-2021-70116)

OTRS is a service management software application from OTRS Germany. OTRS suffers from an information disclosure vulnerability that arises from the software generating support packages that contain private S/MIME and PGP keys if the contained folder is not hidden. No details of the vulnerability...

The vulnerability of microprogramming software in Samsung Galaxy S2, Galaxy Note 2, and Meizu MX devices stems from deficiencies in access control mechanisms, allowing attackers to escalate their privileges through specially created applications.

The vulnerability of microprogramming software in Samsung Galaxy S2, Galaxy Note 2, and Meizu MX devices is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges through a specially created application...

CVE-2021-36096

Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG OTRS Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions...

CVE-2021-36096

Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG OTRS Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions...

Design/Logic Flaw

Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG OTRS Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions...