Stormshield SES Evolution 授权问题漏洞

Stormshield SES Evolution is a security solution from the French company Stormshield. An authorization issue vulnerability exists in SES Evolution that originates from a vulnerability that allows some security policies to be read while accessing a computer with the management console installed, a...

CVE-2021-32535

The vulnerability of hard-coded default credentials in QSAN SANOS allows unauthenticated remote attackers to obtain administrator’s permission and execute arbitrary functions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

CVE-2021-32530

OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32531

OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32532

Path traversal vulnerability in back-end analysis function in QSAN XEVO allows remote attackers to download arbitrary files without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32534

QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

ZrLog Cross-Site Scripting Vulnerability (CNVD-2021-46876)

ZrLog is a blog/CMS program developed in Java that is minimalist, easy to use, componentized, and has a low memory footprint. A cross-site scripting vulnerability exists in ZrLog version 2.1.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the userName and email...

Cross site scripting

Cross Site Scripting vulnerability in ZrLog 2.1.0 via the 1 userName and 2 email parameters in post/addComment...

ZrLog 跨站脚本漏洞

ZrLog is a blog/CMS program developed in Java that is minimalist, easy to use, componentized, and has a low memory footprint. A cross-site scripting vulnerability exists in ZrLog version 2.1.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the userName and email...

CVE-2021-29059

A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service ReDOS occurs if the application is provided and checks a crafted invalid SVG string...

PT-2021-6080

Name of the Vulnerable Software and Affected Versions Apache Chainsaw versions prior to 2.1.0 Description The issue is related to a deserialization flaw in the software, which could allow a remote attacker to execute arbitrary code. Recommendations For Apache Chainsaw versions prior to 2.1.0,...

Apache Chainsaw 代码问题漏洞

Apache Chainsaw is a Log4j companion application. A security vulnerability exists in Apache Chainsaw versions prior to 2.1.0 that stems from a deserialization flaw that could lead to malicious code execution...

Social Sharing Plugin - Kiwi 2.1.0 - Unauthenticated Arbitrary WordPress Options Update and Read

The plugin re-introduced an issue in v2.1.0, allowing unauthenticated attacker to update and read arbitrary WordPress options. This could allow them to create admin accounts by enabling registration and setting the user default role to administrator, or to modify the value of siteurl in order to...

CVE-2020-6641

Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain access to some user data via portal manager or portal users parameters...

denial of service in parse_duration version up to 2.1.0

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29932. Reason: This candidate is a duplicate of CVE-2021-29932. Notes: All CVE users should reference CVE-2021-29932 instead of this candidate...

GSD-2021-1000007 denial of service in parse_duration version up to 2.1.0

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29932. Reason: This candidate is a duplicate of CVE-2021-29932. Notes: All CVE users should reference CVE-2021-29932 instead of this candidate...

Authenticated users can exploit an enumeration vulnerability in Harbor

Impact Hidde Smit from Cyber Eagle has discovered an User Enumeration flaw in Harbor. The issue is present in the "/users" api endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained via the "search"...

WordPress plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . Car Seller - Auto Classifieds Script WordPress plugin...

WordPress 插件 SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . Car Seller - Auto Classifieds Script WordPress plugin...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution. Bundler uses a predictable path in /tmp/, which is created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If is is used in a scenario...