IBM Cloud Pak for Security Information Disclosure Vulnerability (CNVD-2021-64546)

IBM Cloud Pak for Security is an application from IBM USA, Inc. an open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated actions faster.IBM Cloud Pak for Security has a security vulnerability that could allow an attacker t...

FortiSandbox - SQL Injection vulnerabilities

Instances of SQL Injection vulnerabilities in FortiSandbox's checksum search and MTA-quarantine modules may allow an authenticated attacker to execute unauthorized code on the underlying SQL interpreter via specifically crafted HTTP requests...

FortiSandbox - Command injection in web interface

An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests...

CVE-2021-36702: Improper Neutralization of Input During Web Page Generation

The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting XSS vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through...

FortiPortal - Pervasive SQL injections

Multiple improper neutralization of special elements used in an SQL command vulnerabilities CWE-89 in FortiPortal may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL database via specifically crafted HTTP requests...

PT-2021-7464

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 3.1.0 through 3.1.4 FortiSandbox versions 3.2.0 through 3.2.2 Description The issue is related to a lack of protection against SQL query structure attacks in the MTA adapter module for email message checking and the...

CVE-2021-29697

IBM Cloud Pak for Security CP4S 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive information through HTTP requests that could be used in further attacks against the system...

Information disclosure

IBM Cloud Pak for Security CP4S 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive information through HTTP requests that could be used in further attacks against the system...

CVE-2021-29697

CVE-2021-29697 affects IBM Cloud Pak for Security (CP4S) releases 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0. The issue enables a remote authenticated attacker to disclose sensitive information via HTTP requests, potentially enabling further attacks. Affected component/underlying ca...

CVE-2021-29697: Undefined Security Weakness

IBM Cloud Pak for Security CP4S 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive information through HTTP requests that could be used in further attacks against the system...

Panasonic Sanyo CCTV Network Camera 2.03-0x CSRF Disable Authentication / Change Password

Summary SANYO network camera and network optional board with the latest H.264 compression technology provide the optimum surveillance applications with high quality real time moving image at low bandwidth. Simultaneous stream of H.264 and JPEG data and also COAX video out to provide flexible...

CVE-2021-29697

IBM Cloud Pak for Security CP4S 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive information through HTTP requests that could be used in further attacks against the system...

Cross-Site Request Forgery (CSRF) in pimcore/pimcore

✍️ Description Your application have not any CSRF protection and also You set the SameSite attribute to Lax, this means if you want to alter some data with GET HTTP requests, then your site should be vulnerable to CSRF attacks with no doubt. First you run this Html payload and then you should see...

Novus Management System Cross-Site Scripting Vulnerability

NOVUS Novus Management System NMS is a management system from NOVUS. Its user interface consists of modular panels that users can adapt to specific systems and operator needs.A cross-site scripting vulnerability exists in Novus Management System version 1.51.2 and earlier. A remote, unauthenticat...

PT-2021-7155

Name of the Vulnerable Software and Affected Versions Oracle Access Manager version 11.1.2.3.0 Description The issue exists due to insufficient input validation in the Rest interfaces for Access Mgr component of Oracle Access Manager. This can be exploited by a remote attacker using specially...

PT-2021-7200

Name of the Vulnerable Software and Affected Versions Hyperion Essbase Administration Services versions 11.1.2.4 through 21.2 Description The issue exists due to insufficient input validation in the EAS Console component of Oracle Hyperion Essbase Administration Services. This allows a remote...

CVE-2021-34821

Cross Site Scripting XSS vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remote, unauthenticated attacker may be able to exploit the issue by sending malicious HTTP requests to non-existing URIs. The value of the URL...

D-LINK DIR-3040 Information Disclosure Vulnerability (CNVD-2021-53338)

The D-LINK DIR-3040 is a router from D-Link, a Taiwan-based company that provides connectivity to the Internet.The D-LINK DIR-3040 is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to send HTTP requests resulting in the disclosure of sensitive...

Cross-Site Request Forgery (CSRF) in seriawei/zkeacms

✍️ Description ZKEACMS is vulnerable to Cross-site request forgery. The app has no mechanism against CSRF in all HTTP requests. 🕵️‍♂️ Proof of Concept Sample: Add products to the shopping cart. HTML content: HTML setTimeout = form.submit , 2000; 1. Save the above content into an HTML file. 2. With...

IBM Security Access Manager Log Information Disclosure Vulnerability

IBM Security Access Manager is a product for information security management applications from IBM, USA. The product enables access management control through integrated devices for web, mobile and cloud computing. IBM Security Access Manager Docker A log information disclosure vulnerability exis...