128 matches found
PT-2021-17040 · Synology · Synology Diskstation Manager
Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-3 Description: The issue is an out-of-bounds write vulnerability in the synoagentregisterd component. This allows man-in-the-middle attackers to execute arbitrary code via the syn...
Synology DiskStation Manager 缓冲区错误漏洞
Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A security vulnerability exists in faad in Synology DiskStation Manager...
Synology DiskStation Manager Sensitive Information Plaintext Transfer Vulnerability
Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A sensitive information clear text transfer vulnerability exists in Synology...
PT-2020-16750 · Synology · Synology Diskstation Manager
Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-2 Description: The issue concerns the cleartext transmission of sensitive information in DDNS, allowing man-in-the-middle attackers to eavesdrop on authentication information of...
PT-2020-16747 · Synology · Synology Diskstation Manager
Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-2 Description: The issue makes it easier for remote attackers to capture session cookies by intercepting their transmission within an HTTP session, as the Secure flag is not set f...
PT-2020-16746 · Openvpn +1 · Openvpn +1
Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-2 Description: The issue is related to improper certificate validation in the OpenVPN client, allowing man-in-the-middle attackers to spoof servers and obtain sensitive informatio...
CVE-2020-13971
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication...
CVE-2020-13970
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery SSRF in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server...
PT-2020-6439
Name of the Vulnerable Software and Affected Versions FortiOS versions 6.0.0 through 6.0.9 FortiOS versions 6.2.0 through 6.2.3 FortiOS version 6.4.0 Description An improper authentication issue exists in the SSL VPN functionality of FortiOS. This allows attackers to bypass two-factor...
PT-2020-6248 · Python Imaging Library +2 · Pillow +2
Name of the Vulnerable Software and Affected Versions: Pillow versions prior to 7.1.0 Pillow versions 7.x prior to 7.0.1 Pillow version 6.2.2 and earlier Description: The issue is related to multiple out-of-bounds reads in the libImaging/FliDecode.c library. This could allow a remote attacker to...
Cisco Firepower Device Manager On-Box software Buffer Overflow Vulnerability
Cisco Firepower Device Manager FDM is a firewall device manager from Cisco USA. The product supports access rule configuration, system monitoring, etc. Cisco Firepower Device Manager On-Box software is one of the built-in software. A buffer overflow vulnerability exists in the XML parser code in...
Synology DSM AppArmor synosearchagent misconfiguration vulnerability
Summary A misconfiguration exists in AppArmor’s synosearchagent profile of Synology DSM 6.2.3 25426 DS120j. A specially crafted kernel module can be loaded, leading to a bypass of AppArmor’s restrictions. An attacker can use insmod to trigger this vulnerability. Tested Versions Synology DSM 6.2.3...
Apache Traffic Server (ATS) Multiple HTTP Request Smuggling Vulnerabilities
Apache Traffic Server is prone to multiple HTTP request smuggling vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Exploit for Unquoted Search Path or Element in Fortinet Forticlient
Unquoted Service Path exploit in FortiClient CVE-2019-17658...
Design/Logic Flaw
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with world-readable and world-writable permissions. If a sensitive system file were edited this way, a low-privilege user may...
PT-2019-5737 · Fortinet · Fortimanager +1
Name of the Vulnerable Software and Affected Versions: FortiManager versions 6.2.3 and below FortiAnalyzer versions 6.2.3 and below Description: The issue is related to the use of a hard-coded cryptographic key in the CLI configuration of FortiManager and FortiAnalyzer, which may allow an attacke...
CVE-2019-18656
Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements...
CVE-2019-18656
Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements...