PT-2023-25299 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF. Recommendations: At the...

Mitel MiVoice Connect 命令注入漏洞

Mitel MiVoice Connect is Mitel Canada's software for centralized management of Mitel Networks' call processing and collaboration tools. A security vulnerability exists in Mitel MiVoice Connect version 9.6.2208.101 and prior versions, which stems from an insufficient restriction of URL parameters,...

CVE-2023-26735

blackboxexporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources. NOTE: this is disputed by third parties because authentication can be configured...

Apache Superset 代码问题漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A server-side request forgery vulnerability exists in Apache Superset version 2.0.1 and earlier. The vulnerability stems from the product failing to properly validate user input and can be...

SUSE CVE-2009-0037

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file:...

SUSE CVE-2009-0801

Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a...

SUSE CVE-2010-1632

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server WAS 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly...

SUSE CVE-2011-3639

The modproxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of 1 RewriteRule and 2 ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to...

SUSE CVE-2011-4317

The modproxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of 1 RewriteRule and 2 ProxyPassMatch pattern matches for configuration of a reverse proxy, which...

Mitel MiVoice Connect 命令注入漏洞

Mitel MiVoice Connect is Mitel Canada's software for centralized management of Mitel Networks' call processing and collaboration tools. A security vulnerability exists in Mitel MiVoice Connect 19.3 22.22.6100.0 and prior versions, which stems from an insufficient restriction of URL parameters in...

Synology DiskStation Manager 代码问题漏洞

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology, a Chinese company. The operating system manages data, files, photos, music and other information. A code issue vulnerability exists in Synology DiskStation Manager DSM versions prior to...

CVE-2022-23678

A vulnerability in the Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access VIA client for Microsoft Windows...

CVE-2022-23678

A vulnerability in the Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access VIA client for Microsoft Windows...

CVE-2022-23678

A vulnerability in the Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access VIA client for Microsoft Windows...

CVE-2022-23678

A vulnerability in the Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access VIA client for Microsoft Windows...

PT-2022-16187 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system versions 4.3.0 build 2208101 and below Description: A vulnerability in the Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system client...

PublicCMS 代码问题漏洞

PublicCMS is an open source content management system CMS written in Java by PublicCMS, China. publicCMS 4.0.202011.b previous versions exist server-side request forgery vulnerability, the vulnerability stems from the file parameter for access to the IP and domain name is not restricted. An...

Aruba Networks Virtual Intranet Access 信息泄露漏洞

Aruba Networks Virtual Intranet Access is a virtual Intranet access agent from Aruba Networks, Inc. It provides an automatic secure connection for laptops. An information disclosure vulnerability exists in Aruba Networks Virtual Intranet Access version 4.3.0, which stems from the application...

OneBlog 代码问题漏洞

OneBlog is a beautiful and powerful Java blog. OneBlog v2.3.4 version exists server-side request forgery vulnerability, the vulnerability stems from the Link module under the Logo parameter fails to correctly validate the user input, an attacker can use the vulnerability to probe the server...

XML External Entity (XXE) Injection

Overview UmbracoCms.Core is an ASP.NET CMS. Affected versions of this package are vulnerable to XML External Entity XXE Injection via importDocumenttype.aspx.cs. Exploiting this vulnerability allows the attacker to obtain sensitive information by reading files on the server or sending TCP request...