CVE-2021-21876

CVE-2021-21876 affects Lantronix PremierWave 2050 Web Manager. Vulnerable due to OS command injection in the FsTFtp handling of authenticated HTTP requests (PUT/GET). The vulnerability arises when user-supplied parameters (cwd, local, remote, host, port, etc.) are assembled into a system call wit...

CVE-2021-21935: Improper Neutralization of Special Elements used in an SQL Command

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘hostaltfilter2’ parameter. This can be done as any authenticated user or through cross-site request forgery...

PT-2021-14826 · Lantronix · Lantronix Premierwave 2050

Name of the Vulnerable Software and Affected Versions: Lantronix PremierWave 2050 version 8.9.0.0R4 Description: A directory traversal issue exists in the Web Manager FsBrowseClean functionality, allowing an attacker to make a specially crafted HTTP request that can lead to arbitrary file deletio...

PT-2021-14809 · Lantronix · Premierwave 2050 Firmware

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue allows specially-crafted HTTP requests to lead to arbitrary command execution in "GET" requests. An attacker can make authenticated HTTP requests to trigger this vulnerability...

CVE-2021-21878: Exposure of Resource to Wrong Sphere

A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted series of HTTP requests can lead to local file inclusion. An attacker can make a series of authenticated HTTP requests to trigger thi...

CVE-2021-21933: Improper Neutralization of Special Elements used in an SQL Command

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘esnfilter’ parameter. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21923: Improper Neutralization of Special Elements used in an SQL Command

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘companyfilter’ parameter with the administrative account or through cross-site request forgery...

CVE-2021-21877: Improper Neutralization of Special Elements used in an OS Command

Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authenticated HTTP requests to trigger this vulnerability...

PT-2021-14810

Name of the Vulnerable Software and Affected Versions Lantronix PremierWave 2050 version 8.9.0.0R4 Description A local file inclusion issue exists in the Web Manager Applications and FsBrowse functionality. This can be triggered by a specially-crafted series of HTTP requests, allowing an attacker...

CVE-2021-22056

VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with network access may be able to make HTTP requests to arbitrary origins and read the full response...

CVE-2021-22056

VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with network access may be able to make HTTP requests to arbitrary origins and read the full response...

PT-2021-6847

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access versions 20.10 through 21.08 VMware Identity Manager versions 3.3.3 through 3.3.5 Description The issue is related to insufficient validation of incoming requests, allowing a remote attacker to impact the...

Zucchetti Axess CLOKI Access Control 1.64 Cross Site Request Forgery

!-- Zucchetti Axess CLOKI Access Control 1.64 CSRF Disable Access Control Vendor: Zucchetti Axess S.p.A. Product web page: https://www.axesstmc.com Affected version: 1.64 1.63 1.54 Summary: CLOKI is the pre-installed application on our terminals that provides simple to use access control manageme...

Zucchetti Axess CLOKI Access Control 1.64 - Cross Site Request Forgery (CSRF)

Exploit Title: Zucchetti Axess CLOKI Access Control 1.64 - Cross Site Request Forgery CSRF Date: 13/12/2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.axesstmc.com/cloki/ !-- Zucchetti Axess CLOKI Access Control 1.64 CSRF Disable Access Control Vendor: Zucchetti Axess S.p.A. Product...

Exploit for Path Traversal in Grafana

CVE-2021-43798 CVE-2021-43798 is a vulnerability marked as Hi...

CVE-2021-43071

A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the LogReport API controller...

Heap overflow

A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the LogReport API controller...

CVE-2021-43071

A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the LogReport API controller...

CVE-2021-43071

A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the LogReport API controller...

Fortinet FortiWeb Buffer Overflow Vulnerability (CNVD-2021-101138)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A buffer overflow vulnerability exists that...