Authentication flaw

A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and...

CVE-2021-23847

Summary: CVE-2021-23847 describes an unauthenticated information-extraction/settings-change flaw in Bosch IP cameras (CPP6, CPP7, CPP7.3) before firmware B128, on versions 7.70, 7.72, and 7.80. The root cause is a Missing Authentication in a Critical Function, allowing a remote attacker to craft ...

CVE-2021-23847 Unauthenticated Information Extraction Vulnerability

A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and...

The vulnerability of the GJSON library in Aurora Application Software, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the GJSON library used in Avora software applications is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending a specially crafted JSON request...

CVE-2020-26516

A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. Requests sent to the server that trigger actions do not contain a CSRF token and can therefore be entirely predicted allowing attackers to cause the victim's browser to execute undesired actions in the web application...

BMXNOR0200H Ethernet/Serial RTU module 信息泄露漏洞

The Schneider Electric BMXNOR0200H Ethernet/Serial RTU module is an Ethernet Serial RTU Remote Terminal Unit module from Schneider Electric France. An information disclosure vulnerability exists in the Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and earlier versions, which originates when a specially...

CVE-2021-29099

A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed not customer datasets. Web Services that use file based data sources file Geodatabase or Shape Files...

Stack overflow

A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as...

IBM WebSphere eXtreme Scale 安全漏洞

IBM WebSphere Exteme Scale is a resilient, highly scalable in-memory data grid from IBM USA. It can provide predictable responsiveness to meet exponential demands on data. A security vulnerability exists in IBM WebSphere eXtreme Scale Liberty Deployment XSLD, which can be exploited by a remote...

CVE-2021-22699

Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of service when specific crafted requests are sent to the controller over HTTP...

CVE-2021-1553

Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper...

CVE-2021-1549

Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper...

CVE-2021-20996 WAGO: Managed Switches: Unsecure Cookie settings

In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties...

The vulnerability of the traffic balancing system with integrated WEB-security and data filtering services provided by FortiWAN arises from errors in processing the relative path to the catalog. This allows attackers to bypass authentication processes, delete arbitrary files, and reset the administrator password to a default value.

The vulnerability of the traffic balancing system with integrated WEB-security and data filtering services in FortiWAN is related to errors in processing the relative path to the catalog. Exploiting this vulnerability allows a malicious actor to bypass authentication processes and delete arbitrar...

The vulnerability of the Apache OFBiz resource planning software lies in its ability to restore unreliable data in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Apache OFBiz’s resource planning software lies in its ability to restore unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted request...

The vulnerability in the vManage web interface of the software-defined Cisco SD-WAN network allows a malicious individual to gain unauthorized access to protected information.

The vulnerability in the vManage web interface of the Cisco SD-WAN software-defined network is related to authentication process errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by sending specially crafted HTTP requests...

CVE-2021-23016

On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests t...

Code injection

On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests t...

MOXA NPort IA5150A Series 安全漏洞

The Moxa NPort IA5150A Series is a set of industrial control device servers.The Moxa NPort IA5150A Series is vulnerable to the transfer of sensitive information in clear text, allowing remote attackers to exploit the vulnerability to submit special requests that can obtain sensitive information...

The vulnerability of the Remote Development Extension Pack, a plugin for the Microsoft Visual Studio Code editor, allows a hacker to execute arbitrary code.

The vulnerability of the Remote Development Extension Pack, a development extension for the Microsoft Visual Studio Code editor, is related to improper code generation management. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending a specially crafted reques...