Delta Electronics DIAEnergie路径遍历漏洞

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.A path traversal...

Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-27439)

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.Delta Electronics...

Delta Electronics DIAEnergie信息泄露漏洞

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.Delta Electronics...

Snapt Aria Cross-Site Request Forgery Vulnerability

Snapt Aria is an enterprise ADC solution from Snapt USA that provides a load balancer, web gas pedal, web application firewall WAF, global server load balancer GSLB, etc. A cross-site request forgery vulnerability exists in Snapt Aria version 12.8, which stems from a WEB application that does not...

Snapt Aria Command Injection Vulnerability

Snapt Aria is an enterprise-oriented ADC solution from Snapt USA that provides a load balancer, Web gas pedal, Web Application Firewall WAF, Global Server Load Balancer GSLB, etc. A command injection vulnerability exists in the snaptPowered2 component of Snapt Aria v12.8, which could be exploited...

Image optimization & Lazy Load < 3.3.2 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfilteredhtml capability is disallowed. PoC Put the following payload in the Media Optimole...

CVE-2021-42194

The wechatreturn function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml load String function, which itself does not prohibit external entities, triggering a XML external entity XXE injection vulnerability...

GHSA-8V3J-JFG3-V3FV Prototype Pollution in Sails.js

Sails.js = 1.5.2 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules. A patch is available in the master branch of Sails.js's GItHub repository...

CVE-2022-26081

The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer...

CVE-2021-44908

CVE-2021-44908 describes a prototype pollution flaw in Sails.js where the vulnerability exists in the function loadActionModules() inside controller/load-action-modules.js. The affected software is Sails.js versions up to and including 1.4.0. The underlying cause is prototype pollution, enabling ...

Sails.js 注入漏洞

Sails.js is a Node.js-based web application framework from Sails, Inc. Sails.js suffers from an injection vulnerability that originates in the loadActionModules function in controller/load-action-modules.js, which is susceptible to a prototype contamination vulnerability. The vulnerability affect...

Authentication flaw

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and...

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.

...

Samsung Bixby Touch安全漏洞

An access control error vulnerability exists in Samsung Bixby Touch, a virtual intelligent assistant for Samsung mobile devices, which stems from a failure to properly restrict access to resources from unauthorized roles in Bixby Touch. An attacker could exploit the vulnerability to allow untrust...

PT-2022-17550 · Samsung · Bixbytouch

Name of the Vulnerable Software and Affected Versions: BixbyTouch versions prior to 2.2.00.6 Description: The issue is related to improper access control, allowing untrusted applications to load arbitrary URL and local files in webview. Recommendations: For versions prior to 2.2.00.6, update to...

CVE-2021-24825

The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ v 4.0.1 or Admin+ v 4.0.2 users to display arbitrary files from the filesystem such as logs, .htaccess etc, as well as perform Local File Inclusion...

CVE-2021-3656

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB virtual machine control block provided by the L1 guest to spawn/handle a nested guest L2. Due to improper validation of the "virtext" field, this issue could allow a malicious...

CVE-2021-23191

A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function imageloadjpeg in image.cxx may result in denial of service...

AZL-8871 CVE-2022-25634 affecting package qt5-qtsvg for versions less than 5.12.11-3

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory...

Access to XMLHTTPRequest at <URL> from origin <URL>has been blocked by CORS policy

When navigating to load balanced VIP, 'Cannot Complete Your Request' is seen .HAR file will showAccess to XMLHTTPRequest at from origin has been blocked by CORS policy...