Huawei HarmonyOS 输入验证错误漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. Huawei HarmonyOS contains a security vulnerability that could be exploited by attackers to compromise user availability...

The vulnerability of the Remote Access Connection Manager (RASMan) service in the Microsoft Windows operating system allows a hacker to compromise and disclose sensitive information.

The vulnerability of the Remote Access Connection Manager RASMan service in the Microsoft Windows operating system is related to the disclosure of information. Exploiting this vulnerability could allow a attacker to disclose the protected information...

GNU Mailman Cross-Site Scripting Vulnerability (CNVD-2021-88206)

GNU Mailman is a free suite of software from the GNU community for managing e-mail discussions and e-mail lists. The software can be integrated with Web projects to make it easy for users to manage email subscription accounts and provides built-in archiving, automatic forwarding processing, conte...

The vulnerability of Yokogawa’s software products stems from lack of access control mechanisms. This allows attackers to generate false system or technological alarm signals, or block existing alarm signals.

The vulnerability of Yokogawa’s software products is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to generate false system or technological alarm signals, or block existing alarm signals...

PT-2021-7560 · Lantronix · Lantronix Premierwave 2050

Name of the Vulnerable Software and Affected Versions: Lantronix PremierWave 2050 affected versions not specified Description: A specially-crafted HTTP request can lead to arbitrary command execution in the keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this...

AMD Platform Security Processor 安全漏洞

AMD Platform Security Processor is a security processor from AMD. AMD Platform Security Processor suffers from a security vulnerability that stems from an attacker's ability to exploit multiple vulnerabilities in AMD processors...

Microsoft Windows Installer Elevation of Privilege Vulnerability

Microsoft Windows Installer is a component of the Windows operating system from Microsoft. It provides a standard basis for installing and uninstalling software. An elevation of privilege vulnerability exists in Microsoft Windows Installer, which can be exploited by an attacker to elevate...

HarmonyOS Security Bypass Vulnerability (CNVD-2021-87048)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security bypass vulnerability exists in HarmonyOS versions prior to 2.0, where a component of HarmonyOS does not adequately validate data authenticity...

HarmonyOS Buffer Overflow Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A buffer overflow vulnerability exists in HarmonyOS prior to version 2.0, which stems from a heap-based buffer overflow vulnerability in a component of...

HarmonyOS Input Validation Error Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An input validation error vulnerability exists in HarmonyOS prior to version 2.0, which stems from an incorrect input validation vulnerability in a component...

Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers

A recently discovered vulnerability in Apache HTTP Server CVE-2021-41733 is being actively exploited in the wild. This vulnerability is a path traversal and file disclosure vulnerability that could allow an attacker to map URLs outside of the document root. It could also result in the exposure...

Improper Access Control in cortezaproject/corteza-server

Hi, Old unused Password reset tokens are not getting expired after using the new one. Suppose I am an attacker and I got access to the recovery email option of victim account. I logged in to victim recovery email suppose that is [email protected]. Then I used the forget password option. I will get o...

Open Redirect in fisharebest/webtrees

Description OpenRedirect at login with parameter &url= Proof of Concept // PoC.request POST /demo-stable/index.php?route=%2Fdemo-stable%2Flogin%2Fdemo HTTP/2 Host: dev.webtrees.net Cookie: Secure-WT-ID=ekks8678620p55do7do21jd4p1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:93.0...

ROS-2-1929

2.1929 Multiple Exim Server Vulnerabilities 1. Vulnerability description: CVE-2020-28007 A vulnerability in the Exim message forwarding agent, is related to a symbolic link in the Exim log directory. Exploitation of the vulnerability could allow an attacker to create a special symbolic link to a...

IBM AIX Denial of Service Vulnerability

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. A denial of service vulnerability exists in IBM AIX version 7.1, 7.2, and VIOS version 3.1. A local attacker could exploit this vulnerability to cause a denial of service...

Weak password vulnerability in SRG3260 of Huawei Technologies Co.

Huawei Technologies Co., Ltd. is a leading global information and communications technology ICT solutions provider specializing in ICT. A weak password vulnerability exists in Huawei Technologies SRG3260, which can be exploited by attackers to obtain sensitive information...

Rust 缓冲区错误漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause memory corruption...

Cross-Site Request Forgery (CSRF) in zhongshaofa/easyadmin

✍️ Description Attacker able to upload any picture with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks...

2021 CWE Top 25 Most Dangerous Software Weaknesses

The Homeland Security Systems Engineering and Development Institute, sponsored by the Department of Homeland Security and operated by MITRE, has released the 2021 Common Weakness Enumeration CWE Top 25 Most Dangerous Software Weaknesses list. The Top 25 uses data from the National Vulnerability...

SAP 3D Visual Enterprise Viewer Input Validation Error Vulnerability (CNVD-2022-33134)

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP Germany. The software supports publishing 2D and 3D scenes in all industry-standard desktop applications and supports separate installations as standalone executables and ActiveX spaces.SAP 3D Visual Enterprise Viewer is vulnerable to a...