10832 matches found
CVE-2021-22849
CVE-2021-22849 affects Hyweb HyCMS-J1; the backend editing function does not filter special characters, enabling stored XSS where logged-in users can inject JavaScript. Root cause: insufficient input sanitization on editing payloads. Documented impact includes stored XSS risk with potential parti...
IBM Security Guardium SQL Injection Vulnerability (CNVD-2021-05465)
IBM Security Guardium is a comprehensive data protection solution that offers a full range of data security features from compliance support to dynamic data shielding. An SQL injection vulnerability exists in IBM Security Guardium 10.6, 11.2. An attacker can exploit this vulnerability by sending...
DEBIAN-CVE-2021-21239
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does no...
PYSEC-2021-49
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does no...
CVE-2021-21239
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does no...
UBUNTU-CVE-2021-21239
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does no...
Exploit for Improper Authentication in Projectsend
This repository contains the description of the vulnerability fo...
PT-2021-14350
Name of the Vulnerable Software and Affected Versions: PySAML2 versions prior to 6.5.0 Description: The issue is related to an improper verification of cryptographic signatures in PySAML2, a pure python implementation of SAML Version 2 Standard. Users of PySAML2 that use the default...
Information Disclosure Vulnerability in Fibrsol Global Network FS801GW
Fibsol Global Networks Ltd. specializes in the design, development and manufacture of fiber optic networking products and components. Fibrsol Global Network FS801GW suffers from an information disclosure vulnerability, which can be exploited by an attacker to successfully log in to the backend vi...
Prestashop SQL注入漏洞
Prestashop is a set of open source e-commerce solutions from the United States Prestashop. The solution provides a variety of payment methods , short message alerts and product image scaling and other features . PrestaShop 1.7.7.0 suffers from a SQL injection vulnerability in which the source...
Weak password vulnerability in Syrotech SY-GPON-1110-WDAONT and SY-GPON-1110-WDCONT backends
The SY-GPON-1110-WDAONT and SY-GPON-1110-WDCONT are Syrotech routers, respectively. A weak password vulnerability exists in the backend of the Syrotech SY-GPON-1110-WDAONT and SY-GPON-1110-WDCONT, which can be exploited by an attacker to successfully log in to the backend management system and...
CVE-2020-35929
In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This information could be used by an attacker for unauthorized access to remote data...
File Upload Vulnerability in HadSky Backend
HadSky is a PHP + MySQL based open source forum program. A file upload vulnerability exists in the backend of HadSky. An attacker can exploit this vulnerability to gain server privileges...
Security update for openldap2 (moderate)
openSUSE Security Update: Security update for openldap2 Announcement ID: openSUSE-SU-2021:0107-1 Rating: moderate References: 1178909 1179503 Cross-References: CVE-2020-25709 CVE-2020-25710 Affected Products: openSUSE Leap 15.2 An update that fixes two vulnerabilities is now available. Descriptio...
CVE-2021-23835
CVE-2021-23835 affects flatCore prior to 2.0.0 build 139. The issue is a local file disclosure in the docs_file HTTP request body parameter of the acp interface, which accepts malicious user input and can reveal sensitive backend files (e.g., /etc/passwd, SQLite DBs, PHP source) when an attacker ...
SUSE SLED15 / SLES15 Security Update : openldap2 (SUSE-SU-2021:0129-1)
This update for openldap2 fixes the following issues : Security issues fixed : CVE-2020-25709: Fixed a crash caused by specially crafted network traffic bsc1178909. CVE-2020-25710: Fixed a crash caused by specially crafted network traffic bsc1178909. Non-security issue fixed : Retry binds in the...
SUSE-SU-2021:0129-1 Security update for openldap2
This update for openldap2 fixes the following issues: Security issues fixed: - CVE-2020-25709: Fixed a crash caused by specially crafted network traffic bsc1178909. - CVE-2020-25710: Fixed a crash caused by specially crafted network traffic bsc1178909. Non-security issue fixed: - Retry binds in t...
SQL injection vulnerability in miku cms backend cm***_bo***_ed***.php file
Miku cms is a movie and TV management system designed for webmasters with different needs. A SQL injection vulnerability exists in the cmboed.php file in the backend of Miku cms. An attacker can exploit the vulnerability to obtain sensitive information from the database...
Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2021-9006)
The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9006 advisory. - xen-blkback: set ring-xenblkd to NULL after kthreadstop Pawel Wieczorkiewicz Orabug: 32260252 CVE-2020-29569 - xenbus/xenbusbackend: Disallow...