Server-Side Request Forgery (SSRF)

concrete5/concrete5 is vulnerable to server-side request forgery. The vulnerability exists through the local IP importing in 'file.php' which allows an attacker to read the files from private local LAN servers and exploit the local network apps...

GHSA-GQPW-9Q54-9X28 Server-Side Request Forgery in Concrete CMS

Concrete CMS formerly concrete5 versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb...

PortlandLabs Concrete Cms Code Problem Vulnerability

PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. PortlandLabs Concrete CMS has a code issue vulnerability that can be exploited by attackers in a private LAN and exploit local network appandb...

CVE-2021-3793: Improper Protection of Alternate Path

An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the same network as the device to access administrative pages that could result in information disclosure or device firmware update with verified...

OESA-2021-1392 sane-backends security update

SANE Scanner Access Now Easy is a sane and simple interface to both local and networked scanners and other image acquisition devices like digital still and video cameras. Security Fixes: An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local...

Microsoft .NET Core和Microsoft Visual Studio 信息泄露漏洞

Microsoft .NET Core and Microsoft Visual Studio are both products of Microsoft Corporation USA. NET Core is a free and open source development platform. NET Core is a free, open source development platform that features multi-language support and cross-platform capabilities.Microsoft Visual Studi...

CVE-2021-40109

A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents...

CVE-2021-40109

A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents...

CVE-2021-40109

A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents...

PT-2021-22817

Name of the Vulnerable Software and Affected Versions Concrete CMS versions through 8.5.5 Description A Server-Side Request Forgery SSRF issue allows users to access forbidden files on their local network. Users with permissions to upload files from external sites can upload a URL that redirects ...

CVE-2021-40109: Server-Side Request Forgery (SSRF)

A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents...

CVE-2021-41504

An Elevated Privileges issue exists in D-Link DCS-5000L v1.05 and DCS-932L v2.17 and older. The use of the digest-authentication for the devices command interface may allow further attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the...

PT-2021-23315 · D Link · Dcs-932L +1

Name of the Vulnerable Software and Affected Versions: DCS-5000L version 1.05 and earlier DCS-932L version 2.17 and earlier Description: The issue is related to incorrect access control, allowing malicious users on the LAN to access the device due to the use of basic authentication for the device...

D-link Dcs-932L和D-link Dcs-5000L 安全漏洞

D-link Dcs-5000L is an Ip network surveillance camera. d-link Dcs-932L is a network surveillance camera. d-link DCS-5000L and DCS-932L elevation of privilege vulnerability, an attack to can be exploited to compromise the camera configuration and allow a malicious user on the LAN to access the...

CVE-2021-34767

A vulnerability in IPv6 traffic processing of Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, adjacent attacker to cause a Layer 2 L2 loop in a configured VLAN, resulting in a denial of service DoS condition for that...

PT-2024-11385

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.14.9 Description The issue is related to a missing sev decommission in sev receive start, which can result in subsequent SEV launch failures due to firmware memory leaks. According to AMD's SEV API, RECEIVE STA...

Cisco Aironet Access Points 缓冲区错误漏洞

Cisco Aironet Access Points aps is a network access point device from Cisco. A buffer error vulnerability exists in Cisco Aironet Access Points, which stems from an improper implementation of the product's WLAN Control Protocol WCP that prevents the proper handling of unexpected 802.11 data. An...

CVE-2021-37186

A vulnerability has been identified in LOGO! CMR2020 All versions V2.2, LOGO! CMR2040 All versions V2.2, SIMATIC RTU3010C All versions V4.0.9, SIMATIC RTU3030C All versions V4.0.9, SIMATIC RTU3031C All versions V4.0.9, SIMATIC RTU3041C All versions V4.0.9. The underlying TCP/IP stack does not...

PT-2021-6337 · Microsoft · Windows Wlan Autoconfig Service +1

Name of the Vulnerable Software and Affected Versions: Windows WLAN AutoConfig Service affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows WLAN AutoConfig Service, which can be exploited to elevate privileges. This allows an attacke...

CVE-2021-37193: Modification of Assumed-Immutable Data (MAID)

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. An unauthenticated attacker in the same network of the affected system could manipulate certain parameters and set a valid user of the affected software as invalid or vice-versa...