CVE-2021-20764

Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to alter the data of Attaching Files...

CVE-2021-20759

Operational restrictions bypass vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Portal without the appropriate privilege...

CVE-2021-20755

Viewing restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Portal without the viewing privilege...

CVE-2021-31579

Akkadian Provisioning Manager Engine PME ships with a hard-coded credential, akkadianuser:haakkadianpassword. This issue was resolved in Akkadian OVA appliance version 3.0 and later, Akkadian Provisioning Manager 5.0.2 and later, and Akkadian Appliance Manager 3.3.0.314-4a349e0 and later...

CVE-2021-31580

CVE-2021-31580 affects Akkadian Provisioning Manager Engine (PME) and related components, where the OpenSSH channel can be switched from shell to exec, causing a bypass of the restricted shell and enabling command execution within a bash context. The root cause is a misconfigured restricted shell...

Codoforum 跨站脚本漏洞

Codoforum is a set of PHP and MySQL based forum software. A cross-site scripting vulnerability exists in Codoforum version 5.0.2, which can be exploited by an authenticated attacker to execute arbitrary web script or HTML via a crafted payload with the "Pages" parameter...

Codoforum 跨站脚本漏洞

Codoforum is a set of PHP and MySQL based forum software. A cross-site scripting vulnerability exists in Codoforum version 5.0.2, which can be exploited by an attacker to execute arbitrary web script or HTML via a crafted payload with the "Smiley Code" parameter...

GU App 权限许可和访问控制问题漏洞

Extreme Goods Trading GU App is a shopping app from China's Extreme Goods Trading Company. A vulnerability exists in GU App versions 4.8.0 to 5.0.2 due to privilege permission and access control issues, which can be exploited by a remote attacker to direct a user to visit an arbitrary website...

OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated)

Exploit Title: OpenEMR 5.0.1.7 - 'fileName' Path Traversal Authenticated Date 16.06.2021 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://www.open-emr.org/ Software Link: https://github.com/openemr/openemr/archive/refs/tags/v5017.zip Version: All versions prior to 5.0.2 Tested on:...

Security Bulletin: Multiple Security Vulnerabilities affect IBM® Rational® Quality Manager

Summary IBM® Rational® Quality Manager is vulnerable to multiple security vulnerabilities. Vulnerability Details CVEID: CVE-2018-1603 DESCRIPTION: IBM Quality Manager RQM is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus...

Security Bulletin: Security vulnerabilities affect IBM® Rational® Team Concert

Summary IBM Team Concert RTC is vulnerable to multiple cross-site scripting vulnerabilities. Vulnerability Details CVEID: CVE-2018-1408 DESCRIPTION: IBM Team Concert RTC is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus...

Security Bulletin: Security vulnerabilities in Apache Tomcat affect multiple IBM Rational products based on IBM's Jazz technology

Summary The Jazz Team Server is shipped with/or supports versions of the Apache Tomcat web server which contain security vulnerabilities that could potentially impact the following IBM Rational products deployed on Apache Tomcat: Collaborative Lifecycle Management CLM, Rational DOORS Next...

Security Bulletin: Cross-site scripting Vulnerability in IBM® Rational® Quality Manager

Summary IBM® Rational® Quality Manager is affected by a potential cross-site scripting vulnerability Vulnerability Details CVEID: CVE-2017-1609 DESCRIPTION: IBM Quality Manager RQM is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web...

Vaadin flow 安全漏洞

Vaadin flow is a software application, a Java framework for the Vaadin platform, for building modern websites that look good, perform well, and keep you and your users happy. A security vulnerability exists in Vaadin flow that allows an attacker to guess a security token via a timing attack. The...

SUSE: Security Advisory (SUSE-SU-2015:1915-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-25919

In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...

CVE-2021-25918

In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...

Cross site scripting

In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...

CVE-2021-25917

OpenEMR (versions 5.0.2–6.0.0) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is that user input is not properly validated and is rendered on the U2F USB Device authentication method page, allowing a highly privileged attacker to inject arbitrary code when creating a ne...

@duetds/angular (>=5.0.2 <=5.0.3), @duetds/components (>=5.0.2 <=5.0.3) +2 more potentially affected by CVE-2021-23356 via kill-process-by-name (=1.0.5)

kill-process-by-name NPM version =1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on kill-process-by-name and may be impacted: - @duetds/angular =5.0.2, =5.0.2, =1.7.20, =5.0.2, =5.0.3 Source cves: CVE-2021-23356 Source advisory:...