CVE-2021-21640

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names...

CVE-2021-21640: Undefined Security Weakness

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names...

CVE-2020-13421

OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions...

Design/Logic Flaw

OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions...

USN-4902-1 python-django vulnerability

Dennis Brinkrolf discovered that Django incorrectly handled certain filenames. A remote attacker could possibly use this issue to create or overwrite files in unexpected directories...

PT-2021-18375

Name of the Vulnerable Software and Affected Versions FreeBSD versions 13.0-STABLE before n245050 FreeBSD versions 12.2-STABLE before r369525 FreeBSD versions 13.0-RC4 before p0 FreeBSD versions 12.2-RELEASE before p6 Description The issue arises from listening socket accept filters implementing...

PT-2021-9609

Name of the Vulnerable Software and Affected Versions OpenIAM versions prior to 4.2.0.3 Description The issue is related to incorrect access control for certain actions, including Create User, Modify User Permissions, and Password Reset. Recommendations For versions prior to 4.2.0.3, update to...

CVE-2020-13421: Undefined Security Weakness

OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions...

CVE-2021-25156

CVE-2021-25156 describes a remote arbitrary directory creation vulnerability in Aruba Instant Access Point (IAP) products. Affected versions include Aruba Instant 6.4.x (up to 6.4.4.8-4.2.4.17 and below), 6.5.x (up to 6.5.4.18 and below), 8.3.x (up to 8.3.0.14 and below), 8.5.x (up to 8.5.0.11 an...

CVE-2021-25156: Undefined Security Weakness

A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below;...

PT-2021-16429

Name of the Vulnerable Software and Affected Versions: Aruba Instant versions 6.4.4.8 through 6.4.4.17 and below Aruba Instant versions 6.5.4.18 and below Aruba Instant versions 8.3.0.14 and below Aruba Instant versions 8.5.0.11 and below Aruba Instant versions 8.6.0.6 and below Aruba Instant...

Project Expense Monitoring System 1.0 Authentication Bypass Vulnerability

Exploit Title: Project expense Monitoring System | Create Admin Account Unauthorised Exploit Author: Richard Jones Vendor Homepage: https://www.sourcecodester.com/php/14001/project-expense-monitoring-system-project-php-source-code-2020.html Software Link:...

PT-2021-6603 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.6 and later Description: The issue is related to improper authorization, allowing guest users to create issues for Sentry errors and track their status. This could potentially enable a remote attacker to access...

PT-2021-17743 · Netflix · Netflix Oss Hollow

Name of the Vulnerable Software and Affected Versions: Netflix OSS Hollow affected versions not specified Description: The issue allows an attacker to pre-create directories with wide permissions since the Files.existsparent check is performed before creating the directories. Furthermore, the use...

react-dev-utils OS Command Injection in function `getProcessForPort`

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...

GNOME Glib 后置链接漏洞

GNOME Glib is a multi-platform toolkit for creating graphical user interfaces and is the underlying core library for GTK+ and GNOME projects. A security vulnerability exists in GNOME GLib before 2.66.8, which stems from the fact that gfilereplace and GFILECREATEREPLACEDESTINATION incorrectly also...

PT-2021-2410

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 11.6.x before 11.6.5.3 F5 BIG-IP versions 12.1.x before 12.1.5.3 F5 BIG-IP versions 13.1.x before 13.1.3.6 F5 BIG-IP versions 14.1.x before 14.1.4 F5 BIG-IP versions 15.1.x before 15.1.2.1 F5 BIG-IP versions 16.0.x before...

Command injection

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...

Directory traversal

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files such as an executable file under the web root. This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x...

Command Injection in facebook/create-react-app

description react-dev-utils includes some utilities used by Create React App. The function getProcessForPort in react-dev-utils is vulnerable to command injection. PoC Create a .js file with the content below and run it, then the file pzhou@shu can be illegally created. var getProcessForPort =...