PT-2021-9657 · Unknown · Rukovoditel Project Management App

Name of the Vulnerable Software and Affected Versions: Rukovoditel Project Management App version 2.7.2 Description: An exploitable SQL injection issue exists in the "global lists/choices" page. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP...

Rukovoditel SQL注入漏洞

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . Rukovoditel Project Management App 2.7.2 suffers from a SQL injection vulnerability that can be trigger...

Advantech WebAccess/SCADA 路径遍历漏洞

Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. A local file inclusion vulnerability...

CVE-2021-26905

1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...

Design/Logic Flaw

1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...

CVE-2021-26905

1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...

CVE-2020-9301

Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container...

PT-2020-18917 · Wago · Wago Pfc 200

Name of the Vulnerable Software and Affected Versions: WAGO PFC 200 version 03.03.1015 Description: A code execution issue exists in the Web-Based Management functionality, allowing remote code execution through specially crafted HTTP requests. An attacker can trigger this issue by making an...

nodejs: HTTP request smuggling using malformed Transfer-Encoding header

A flaw was found in the Node.js code where a specially crafted HTTPs request sent to a Node.js server failed to properly process the HTTPs headers, resulting in a request smuggling attack. An attacker can use this flaw to alter a request sent as an authenticated user if the Node.js server is...

nodejs: HTTP request smuggling using malformed Transfer-Encoding header

A flaw was found in the Node.js code where a specially crafted HTTPs request sent to a Node.js server failed to properly process the HTTPs headers, resulting in a request smuggling attack. An attacker can use this flaw to alter a request sent as an authenticated user if the Node.js server is...

Command injection

An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker ca...

CVE-2019-5142

An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker ca...

Cisco TelePresence Advanced Media Gateway Denial of Service Vulnerability

Cisco TelePresence Advanced Media Gateway is a high-definition multimedia gateway device from Cisco USA. A security vulnerability exists in the web application in Cisco TelePresence Advanced Media Gateway, which stems from a lack of input validation in the program. A remote attacker could exploit...

CVE-2019-17598

CVE-2019-17598 affects Lightbend Play Framework (2.5.x–2.6.23) and its play-ws component. When configured to proxy requests through an authenticated HTTP proxy, under high load, HTTPS connections to a target host may reveal proxy credentials to that host. Impact is information disclosure; details...

JetBrains TeamCity Cross-Site Scripting Vulnerability (CNVD-2019-39176)

TeamCity is a Java-based build management and continuous integration server from JetBrains. A cross-site scripting vulnerability exists in JetBrains TeamCity 2019.1, 2019.1.1. An attacker can exploit this vulnerability to send arbitrary HTTP requests to the TeamCity server in the name of the...

PT-2019-11643 · Fat Free Crm · Fat Free Crm

Name of the Vulnerable Software and Affected Versions: Fat Free CRM version 0.19.0 Description: A HTML Injection issue has been reported in the Fat Free CRM product, specifically via an authenticated request to the "/comments" URI. The vendor disputes the significance of this report, citing that...

PT-2019-5257

Name of the Vulnerable Software and Affected Versions Atlassian Crowd versions 2.1.0 through 3.0.4 Atlassian Crowd versions 3.1.0 through 3.1.5 Atlassian Crowd versions 3.2.0 through 3.2.7 Atlassian Crowd versions 3.3.0 through 3.3.4 Atlassian Crowd versions 3.4.0 through 3.4.3 Atlassian Crowd Da...

CVE-2018-19981

Amazon AWS SDK =2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have "root" privilege...

PT-2019-8045 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub 2245-222 version 1012 Description: A buffer overflow vulnerability exists in the PubNub message handler. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow, overwriting arbitrary dat...

PT-2019-8044 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub 2245-222 version 1012 Description: A buffer overflow issue exists in the PubNub message handler. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow, overwriting arbitrary data. An...