CVE-2021-39022

IBM Guardium Data Encryption GDE 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value CSV file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software. IBM X-Force ID...

CVE-2021-21708

A flaw was found in PHP. The vulnerability occurs due to the malformed phpfilterfloat function and leads to a use-after-free vulnerability. This flaw allows an attacker to inject a malicious file, leading to a crash or a Segmentation fault...

Path Traversal

@backstage/plugin-scaffolder-backend is vulnerable to Path Traversal. An attacker with access to a registered scaffolder template can manipulate the template by writing files to arbitrary paths on the scaffolder-backend host instance. The vulnerability can be exploited through the user input when...

Ruby: Arbitrary file injection via symlink attack in rdoc generator

Vulnerability description not provided...

ZZCMS SQL注入漏洞

ZZCMS is a content management system CMS from the Zzcms team in China.ZZCMS version 2019 is vulnerable to SQL injection, which stems from the lack of effective filtering and escaping of SQL statements in the subzs.php component. An attacker could use this vulnerability to execute illegal SQL...

Remote Code Execution (RCE)

slogenerator is vulnerable to remote code execution. An attacker may exploit the vulnerability by injecting a maliciously crafted YAML file in a specific format .yml...

EyouCMS directory traversal vulnerability

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework that focuses on the needs of enterprise website users. The vulnerability stems from a lack of input data validation for the tpldir, filename, type, and nid parameters. An attacker could use this...

CVE-2021-39503

PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without ", ?, =, ,...." In WriteConfig function, an attacker can inject php code to /include/config.cache.php file...

CVE-2021-39503

PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without ", ?, =, ,...." In WriteConfig function, an attacker can inject php code to /include/config.cache.php file...

Buffalo和Arcadyan多款路由器认证绕过RCE等多个漏洞

Tenable has discovered multiple vulnerabilities in routers manufactured by Arcadyan. During the disclosure process for the issues discovered in the Buffalo routers, Tenable discovered that CVE-2021-20090 affected many more devices, as the root cause of the vulnerability exists in the underlying...

CVE-2021-0567

In isRestricted of RemoteViews.java, there is a possible way to inject font files due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Andro...

CVE-2021-0567

In isRestricted of RemoteViews.java, there is a possible way to inject font files due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Andro...

Remote Code Execution (RCE)

thunar is vulnerable to remote code execution. An attacker is able to inject malicious code via a file to delegate the system to a different program based on the file type when the file is called as a command-line argument...

CVE-2020-26295

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 an...

DLL Hijacking Vulnerability in Cyberdocument Windows Client

Xunfei Document is an online document software that supports multiple people and multiple ends to edit at the same time, produced by KDDI. Xunfei Document windows client DLL hijacking vulnerability, an attacker can use the vulnerability in the client process to inject executable DLL file, to...

Command Execution Vulnerability in Omni-Directional PDF Converter

Full range of PDF Converter is a very powerful pdf conversion tool, support PDF documents into Word, Excel, PPT, pictures, text, HTML, Epub, XML. A full range of PDF Converter has a command execution vulnerability that can be exploited by an attacker to inject an executable DLL file into the clie...

Command Execution Vulnerability in Hua An Securities Hui Win pc Software

Hua An Securities Hui Win pc version is a stock financial terminal newly launched by Hua An Securities. Huaan Securities Hui Win pc software has a command execution vulnerability, which can be exploited by attackers to inject executable DLL files into client processes and execute arbitrary...

Command Execution Vulnerability in Curtain Client

Curtain Client is a mind mapping software. A command execution vulnerability exists in the Curtain Client, which can be exploited by an attacker to inject an executable DLL file into the client process to perform arbitrary functions...

Command Execution Vulnerability in LeTeachLearn Student Client

LeTeachLearn Student is an app that provides attentive after-school tutoring. A command execution vulnerability exists in LeTaoLeXue Student Client, which can be exploited by an attacker to inject an executable DLL file into the client process to perform arbitrary functions...

Command Execution Vulnerability in Deep Space Programming Live Client

Deep Space Programming Live Client is a live streaming software from Programming Cat. Deep Space Programming Live Client has a command execution vulnerability that can be exploited by an attacker to inject an executable DLL file into the client process to perform arbitrary functions...