17961 matches found
Design/Logic Flaw
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints...
Design/Logic Flaw
The Agent in NinjaRMM 5.0.909 has Insecure Permissions...
Design/Logic Flaw
QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...
Design/Logic Flaw
QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...
Design/Logic Flaw
Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access arbitrary password files. Suggest contacting with QSAN and refer to recommendations in QSAN Document...
Design/Logic Flaw
ARTWARE CMS parameter of image upload function does not filter the type of upload files which allows remote attackers can upload arbitrary files without logging in, and further execute code unrestrictedly...
Design/Logic Flaw
A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior...
(0Day) Autodesk Design Review PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk Design Review. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...
PT-2021-22826 · Autodesk · Autodesk Design Review
Name of the Vulnerable Software and Affected Versions: Autodesk Design Review affected versions not specified Description: The issue arises when a maliciously crafted dwf or .pct file is consumed through the DesignReview.exe application, leading to a memory corruption vulnerability due to a read...
(0Day) Autodesk Design Review DWF File Parsing Memory Corruption Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk Design Review. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...
an-em-design (0.1.0a0), anmotordesign (0.1.0a0) +13 more potentially affected by CVE-2021-32559 via pywin32 (227.0.0)
pywin32 PYPI version 227.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pywin32 and may be impacted: - an-em-design 0.1.0a0 - anmotordesign 0.1.0a0 - creed =0.1.0, =0.0.7.3, =0.0.9, =0.0.1, =0.1.0, =1.0.1, =0.1.1, =0.1.0, =0.5.0 - wordmarker 0.0.1...
Design/Logic Flaw
The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to...
CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2021-48502)
CMS Made Simple CMSMS is an open source content management system that provides developers, programmers, and website owners with a web-based version of the development and management interface. A stored cross-site scripting vulnerability exists in CMS Made Simple version 2.2.14, which can be...
(0Day) Autodesk Design Review DWFX File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autodesk Design Review. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Design/Logic Flaw
Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2020-36416
A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module...
Cross site scripting
A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module...
CVE-2020-36416: Improper Neutralization of Input During Web Page Generation
A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module...
PT-2021-12054
Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.14 Description: A stored cross-site scripting XSS issue allows authenticated attackers to execute arbitrary web scripts or HTML by entering a crafted payload into the Create a new Design parameter under the Designs...
PT-2021-6513 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.11 through 13.11.6 GitLab CE/EE versions 13.12 through 13.12.7 GitLab CE/EE versions 14.0 through 14.0.3 Description: An issue has been discovered in GitLab CE/EE that allows attackers to read arbitrary files on the...