Scalance X Products Heap Buffer Overflow Vulnerability (CNVD-2021-02594)

SCALANCE X is a switch for connecting industrial components such as programmable logic controllers plc or human machine interfaces HMIs. The Scalance X Products heap buffer overflow vulnerability allows an attacker to cause a request for such a scenario on a web server by sending a specially...

多款Cisco产品缓冲区错误漏洞

The Cisco RV110W is a Wireless-N VPN firewall, the Cisco RV130 is a multifunction VPN router, the Cisco RV130W is a Wireless-N multifunction VPN router, and the Cisco RV215W is a Wireless-N VPN router. A remote command execution and denial of service vulnerability exists in the Web management...

多款Cisco产品缓冲区错误漏洞

The Cisco RV110W is a Wireless-N VPN firewall, the Cisco RV130 is a multifunction VPN router, the Cisco RV130W is a Wireless-N multifunction VPN router, and the Cisco RV215W is a Wireless-N VPN router. A remote command execution and denial of service vulnerability exists in the Web management...

Debian: Security Advisory (DSA-4829-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fortinet FortiWeb SQL Injection Vulnerability

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A SQL injection vulnerability exists in...

CVE-2019-4728

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.52, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data. By sending specially crafted request, an attacker could exploit this...

PT-2021-3192 · Gjson · Gjson

Name of the Vulnerable Software and Affected Versions: GJSON versions 1.6.5 and earlier GJSON version 1.6.5 Description: The issue allows attackers to cause a denial of service via a crafted GET call, resulting in a panic due to a runtime error, specifically a slice bounds out of range error. Thi...

phpMyAdmin 4.0.0 < 4.0.10.12 / 4.4.0 < 4.4.15.2 / 4.5.0 < 4.5.3.1 Information Disclosure (PMASA-2015-6)

According to its self-reported version, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.12, 4.4.x prior to 4.4.15.2, or 4.5.x prior to 4.5.3.1. It is, therefore, affected by an information disclosure vulnerability: - libraries/config/messages.inc.php in...

Huawei Mate 30缓冲区错误漏洞

Huawei Mate 30 is a smartphone from the Chinese company Huawei. The Huawei Mate 30 suffers from an out-of-bounds read vulnerability that can be exploited by a remote attacker to submit a special request that can be used in the context of an application to execute arbitrary code...

Raysync 代码注入漏洞

Raysync is a cloud platform for storing and transferring large files. A remote code execution vulnerability exists in Raysync versions prior to 3.3.3.8. The vulnerability can be exploited to remotely execute code on a hosted server by sending a specially crafted request to overwrite a specific fi...

CVE-2020-13527

An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. A specially crafted HTTP request can cause increased privileges. An attacker can send an HTTP request to trigger this vulnerability...

The vulnerability of the WAGO Ethernet controller, related to deficiencies in authentication procedures, allows a perpetrator to alter the device’s settings.

The vulnerability of the WAGO Ethernet controller is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to alter the device’s settings using a specially crafted request...

spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack

A flaw was found in spring-cloud-config in versions prior to 2.1.9 and 2.2.3. Applications are allowed to serve arbitrary configuration files through the spring-cloud-config-server module allowing an attacker to send a request using a specially crafted URL to create a directory traversal attack...

Design/Logic Flaw

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium see security notifications for affected versions, that could cause denial of service when a specially crafted Read Physical Memo...

Nec Platforms Aterm SAG firmware Operating System Command Injection Vulnerability

The Nec Platforms Aterm SA3500G is an appliance from Japan's Nec Platforms that provides security for corporate intranet environments. The appliance includes features such as antivirus, firewall, intrusion detection defense, routing, and link layer support. A security vulnerability exists in the...

Null pointer dereference

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service...

Huawei FusionCompute Command Injection Vulnerability (CNVD-2020-68551)

FusionCompute is Huawei's self-developed computing virtualization software. A command injection vulnerability exists in FusionCompute 6.5.1, 8.0.0. The vulnerability stems from insufficient authentication. An attacker can exploit the vulnerability to gain higher privileges via a specially crafted...

Apache Struts double OGNL evaluation

Added: 11/27/2020 CVE: CVE-2019-0230 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Struts uses Object-Graph Navigatio...

The vulnerability of the Azure Sphere operating system, related to improper code generation management, allows a hacker to execute arbitrary code.

The vulnerability of the Azure Sphere operating system is related to improper code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code by executing a specially crafted request...

The vulnerability of the Azure Sphere operating system, related to improper code generation, allows a hacker to execute arbitrary code.

The vulnerability of the Azure Sphere operating system is related to improper code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created request...