CVE-2021-4230 Airfield Online MySQL Backup improper authentication

A vulnerability has been found in Airfield Online and classified as problematic. This vulnerability affects the path /backups/ of the MySQL backup handler. An attacker is able to get access to sensitive data without proper authentication. It is recommended to the change the configuration settings...

TotoLink A3100R 访问控制错误漏洞

TotoLink A3100R is a series of wireless router TotoLink A3100R V5.9c.4577 from TotoLink Electronics Taiwan, China has an access control error vulnerability, which stems from test.asp contains an API-like function that is not authenticated and can be exploited by an attacker without authentication...

GHSA-MHFV-8RC9-W38C Arbitrary shell execution

Uses of shellexec and exec were not escaping filenames and configuration settings in most cases...

CVE-2022-24915 ICSA-22-062-01 IPCOMM ipDIO

The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. Th...

Authentication flaw

The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafted request that may allow for modification of the configuration settings...

CVE-2020-14504

Rockwell Automation 1734-AENTR Series B/C are affected by CVE-2020-14504 due to an improper access control in the web interface that mishandles HTTP POST authentication, enabling a remote, unauthenticated attacker to modify configuration settings. Affected series and firmware info from sources in...

CVE-2020-14504

The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafted request that may allow for modification of the configuration settings...

Directory traversal

A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the device's file system. This can be used to identify configuration settings, password hashes for built-in accounts, and the cleartext password for remote...

CVE-2020-17383

The CVE-2020-17383 entry documents a directory traversal vulnerability in Telos Z/IP One devices (versions before 4.0.0r). The underlying issue is lack of filtering/escaping of directory parameters and special characters, enabling an unauthenticated attacker to obtain root access to the device fi...

Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

Description A CSRF issue is found in the SettingsLive help configurationFile Configuration. It was found that no CSRF token validation is getting done as no CSRF token is getting passed with the request. Proof of Concept Actual Request POST /siteadmin/file/configuration HTTP/1.1 Host:...

CVE-2021-39971

Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could compromise confidentiality...

CVE-2021-43333

The Datalogic DXU service on for example DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings...

[SECURITY] Fedora 34 Update: redis-6.2.6-1.fc34

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

Denial Of Service (DoS)

xen is vulnerable to denial of service. The unofficial MATLAB extension for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace because of lint configuration settings...

Code injection

A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.0 SP1. Affected devices allow to modify configuration settings over an unauthenticated channel. This could allow a local attacker to escalate privileges and execute own code on the device...

CVE-2021-31338: External Control of System or Configuration Setting

A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.0 SP1. Affected devices allow to modify configuration settings over an unauthenticated channel. This could allow a local attacker to escalate privileges and execute own code on the device...

CVS Health Records for 1.1 Billion Customers Exposed

More than 1 billion records for CVS Health customers were left in the database of a third-party, unnamed vendor – exposed, unprotected, online. Researchers said the data points revealed could be strung together to create an extremely personal snapshot of someones’s medical situation. The glitch i...

EulerOS 2.0 SP3 : squid (EulerOS-SA-2021-1852)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when...

Debian DSA-4899-1 : openjdk-11 - security update

It was discovered that the OpenJDK Java platform incompletely enforced configuration settings used in Jar signing verifications. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4899. The...

Debian: Security Advisory (DSA-4899-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...