CVE-2021-31813

Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details e.g., a crafted user name from AD...

Cross site scripting

Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details e.g., a crafted user name from AD...

CVE-2021-31813

CVE-2021-31813 affects Zoho ManageEngine Applications Manager prior to 15130. The vulnerability is a Stored XSS flaw that occurs when importing malicious user details (e.g., a crafted user name) from Active Directory. Multiple sources (NVD entry, Red Hat advisory, CNVD/CNNVD entries) describe thi...

ZOHO ManageEngine Applications Manager 跨站脚本漏洞

ZOHO ManageEngine Applications Manager is an IT operations management solution from ZOHO, Inc. ZOHO ManageEngine Applications Manager is vulnerable to a cross-site scripting vulnerability that could be exploited to execute malicious JavaScript...

SUSE: Security Advisory (SUSE-SU-2021:2213-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Unspecified vulnerability in 101 applications (CNVD-2021-47376)

101 is an application program . Provides a JS util library. A security vulnerability exists in 101 versions 1.0.0 through 1.6.3, which can be exploited by an attacker to cause a denial of service and potentially lead to remote code execution...

vulhub

This is an open-source, community-driven project called Vulhub, which provides a comprehensive collection of vulnerable systems and applications for educational and testing purposes. The repository contains a wide range of vulnerable systems, including web applications, databases, and networks, a...

CVE-2021-34375

Trusty contains a vulnerability in all trusted applications TAs where the stack cookie was not randomized, which might result in stack-based buffer overflow, leading to denial of service, escalation of privileges, and information disclosure...

Default configuration

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used which is recommended, but is n...

Design/Logic Flaw

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with...

CVE-2021-29485

Ratpack vulnerability CVE-2021-29485 affects versions before 1.9.0 when using Ratpack's session storage. An attacker can achieve remote code execution by crafting a Java deserialization gadget chain in the session data, provided the application writes to the session store. If an application does ...

CVE-2021-29480 Default client side session signing key is highly predictable

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used which is recommended, but is n...

CVE-2021-29480

CVE-2021-29480 affects Ratpack prior to 1.9.0, where the client-side session module uses the application startup time as the signing key by default. If an attacker can determine this time and encryption is not enabled, session data could be tampered with via cookie manipulation. As of Ratpack 1.9...

CVE-2021-29479

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied X-Forwarded-Host header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the X-Forwarded-Host header as a cache key. Users are only vulnerab...

CVE-2021-29479

Summary: Ratpack before 1.9.0 is vulnerable to cache poisoning via the X-Forwarded-Host header. If the cache key does not include X-Forwarded-Host and a custom PublicAddress is not configured, Ratpack’s default inferring PublicAddress can be exploited to redirect cached responses to an attacker s...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.5.0 Security release

Updated Red Hat JBoss Web Server 5.5.0 packages are now available for Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.5.0 security release

Red Hat JBoss Web Server 5.5.0 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and Windows. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detaile...

Linux kernel information disclosure vulnerability (CNVD-2021-60526)

Linux kernel is the kernel used by the Linux Foundation's open source operating system, Linux. Linux kernel is vulnerable due to an excessive amount of data output in the Linux kernel functions, which allows user-state applications to read the contents of a sigpage, thereby leaking the contents o...

5G Security Vulnerabilities Fluster Mobile Operators

As 5G private networks roll out in the coming years, security may be a key issue for enterprises. A survey released at Mobile World Congress on Monday shows that major gaps persist in security capabilities among mobile operators. Some 68 percent of operators already sell private wireless networks...

3 Takeaways From The 2021 VDBIR: It’s An Appandemic

VDBIR Overview “Appandemic” sounds a bit like “appendectomy.” From a societal standpoint, it’s almost as alarming — if not more so — as the surgical procedure is from a personal standpoint. Because in the midst of the global pandemic we’ve all experienced over the past year and a half, web...