3005 matches found
CVE-2021-46009
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies...
Authentication flaw
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies...
CVE-2021-46009: Missing Authentication for Critical Function
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies...
How to disable the tls1.1 and tls1.0 by SSL Profile
This article is to record a method to disable the specific tls version by SSL Profile for SSL Vserver...
Mattermost has an unspecified vulnerability (CNVD-2022-22660)
A security vulnerability exists in Mattermost, an open source collaboration platform from Mattermost, a US-based company, which allows system administrators to combine two different permissions/features in a way that allows them to override certain restricted configurations e.g. EnableUploads. No...
CVE-2022-1003 Sysadmin can override existing configs & bypass restrictions like EnableUploads
One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads...
CVE-2022-1003 Sysadmin can override existing configs & bypass restrictions like EnableUploads
One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads...
Mattermost 安全漏洞
A security vulnerability exists in Mattermost, an open source collaboration platform from Mattermost, a US-based company, which allows system administrators to combine two different permissions/features in a way that allows them to override certain restricted configurations e.g. EnableUploads. No...
STMicroelectronics STSAFE-J 数据伪造问题漏洞
The STMicroelectronics STSAFE-J is a highly secure solution from STMicroelectronics Switzerland. It acts as a security element by providing authentication, data management and encryption services to local or remote hosts. Security vulnerabilities exist in the STMicroelectronics STSAFE-J that coul...
USN-5311-1: containerd vulnerability
It was discovered that containerd allows attackers to gain access to read- only copies of arbitrary files and directories on the host via a specially- crafted image configuration. An attacker could possibly use this issue to obtain sensitive information...
Mozilla VPN 代码问题漏洞
Mozilla VPN is an open source virtual private network web browser extension, desktop application and mobile application from the US-based Mozilla Foundation. Mozilla VPN suffers from a code issue vulnerability that stems from the fact that Mozilla VPN can load OpenSSL configuration files from...
Let’s Get Under the Hood of Imperva Snapshot
A stress-free guide for the prudent cloud operator With minimal setup, Imperva Snapshot enables you to immediately start your in-depth Amazon Web Services AWS RDS database assessment. With no prior training required, cloud operators can use this useful tool to pinpoint deficiencies in their...
Denial of service in github.com/nats-io/nats-server/server
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers - Running a NATS service which is exposed to untrusted users presents a heighten...
Apache Cassandra Code Injection Vulnerability
Apache Cassandra is a distributed Nosql database from the American Apache Apache Foundation. Apache Cassandra suffers from a code injection vulnerability that stems from a network system or product failing to properly filter specific elements of externally entered data during the construction of ...
Hashicorp Nomad 输入验证错误漏洞
Hashicorp Nomad is a distributed, data center-aware cluster and application scheduler from Hashicorp, USA. The program supports the deployment of microservices, batch, containerized and non-containerized applications. HashiCorp Nomad suffers from an Input Validation Error vulnerability that stems...
CVE-2022-22765
BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information ePHI, protected health information PHI and personally identifiable information...
Apache Cassandra 代码注入漏洞
Apache Cassandra is a distributed Nosql database from the American Apache Apache Foundation. Apache Cassandra suffers from a code injection vulnerability that stems from a network system or product failing to properly filter specific elements of externally entered data during the construction of ...
Gradle 安全漏洞
Gradle is a set of JVM-based project build tools from Gradle, Inc. that supports maven, Ivy repositories, and more. Gradle suffers from a security vulnerability that stems from the fact that under certain circumstances, Gradle may skip validation and accept a dependency that would otherwise cause...
CVE-2022-22809
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk V2.6.2 and prior, Wiser for KNX formerly...
Authentication flaw
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk V2.6.2 and prior, Wiser for KNX formerly...