418 matches found
The vulnerability of the Pipeline Manager component of Oracle Communicationsā Billing and Revenue Management software allows a hacker to disclose protected information.
The vulnerability of the Pipeline Manager component of Oracle Communicationsā Billing and Revenue Management software relates to the disclosure of information. Exploiting this vulnerability could allow an attacker to disclose the protected information...
Hardcoded credentials
Malicious translator is able to inject JavaScript code in few translatable strings where HTML is allowed. The code could be executed in the Package manager. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.32 and prior versions, 8.0.x version: 8.0.19 and prior versions...
OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows...
CVE-2021-22968
A bypass of adding remote files in Concrete CMS previously concrete5 File Manager leads to remote code execution in Concrete CMS concrete5 versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored i...
CVE-2021-40991
A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager versions: ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released...
CVE-2021-37959
Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user gestures to potentially exploit heap corruption via a crafted HTML page...
CVE-2021-40711 Adobe Experience Manager Stored Cross-Site Scripting Could Lead to Arbitrary Code Execution
Adobe Experience Manager version 6.5.9.0 and earlier is affected by a stored XSS vulnerability when creating Content Fragments. An authenticated attacker can send a malformed POST request to achieve arbitrary code execution. Malicious JavaScript may be executed in a victimās browser when they...
CVE-2021-28626 Adobe Experience Manager Improper Authorization at /content/usergenerated
Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by an Improper Authorization vulnerability allowing users to create nodes under a location. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service...
Cross-Site Request Forgery (CSRF) in myvesta/vesta
āļø Description Attacker is able to delete any file on the server if logged in user visits attacker website. šµļøāāļø Proof of Concept Create a test.txt file under /home/user when you logged in open this POC.html in a browser you can check test.txt deletes. //PoC.html history.pushState'', '', '/'...
MONITORAPP Application Insight Web Application Firewall ęęé®é¢ę¼ę“
The MONITORAPP Application Insight Web Application Firewall AIWAF is an application firewall from MONITORAPP Corporation in South Korea. A security vulnerability exists in Manager 2.1.0 before B115 on the MONITORAPP Application Insight Web Application Firewall AIWAF appliance, which stems from...
The vulnerability of the RPM package manager RPM in Red Hat Enterprise Linux operating systems allows a hacker to increase their privileges.
The vulnerability of the RPM package manager RPM in Red Hat Enterprise Linux operating systems arises from a situation of competition. Exploiting this vulnerability can allow an attacker to increase their privileges...
The vulnerability of the fly-fm file manager, related to insufficient validation of input data, allows a hacker to trigger a service failure.
The vulnerability of the fly-fm file manager is related to incorrect calculation of MD5 in the program window. Exploiting this vulnerability allows a remote attacker to cause service interruptions...
IBM Engineering Systems Design Rhapsody Access Control Error Vulnerability
IBM Engineering Systems Design Rhapsody is part of the IBM Engineering product portfolio from IBM Corporation, USA. It provides a collaborative design development and test environment for systems engineers supporting UML, SysML, UAF and AUTOSAR. An access control error vulnerability exists in IBM...
CVE-2021-23278
Eaton Intelligent Power Manager IPM prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/mapssrv.js with action removeBackground and server/nodeupgradesrv.js with action removeFirmware. An attacker can send specially...
Cisco Unified Communications Manager č·Øē«čę¬ę¼ę“
Cisco Unified Communications Manager CUCM, Unified CM, CallManager is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A security vulnerability exists ...
Synology DiskStation Manager In-Thread Competitive Condition Vulnerability
DiskStation Manager DSM is an operating system that runs on all Synology NAS and can be operated through an intuitive web interface. An in-thread race condition vulnerability exists in iscsisnapshotcommcore in Synology DiskStation Manager versions prior to 6.2.3-25426-3. A remote attacker can...
Red Hat Package Manager ę°ę®ä¼Ŗé é®é¢ę¼ę“
Red Hat Package Manager is a packaging and installation tool for Internet downloadable packages from Red Hat. It is included in some Linux distributions. It generates files with the .RPM extension. Similar to Dpkg. Red Hat Package Manager suffers from a Data Forgery Problem vulnerability that...
Improper access control vulnerability in JP1/IT Desktop Management 2 - Manager and JP1/NETM/Asset Information Manager
Overview The JP1/IT Desktop Management 2 - Manager and JP1/NETM/Asset Information Manager contains improper access control vulnerability. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the offici...
Beware! Fully-Functional Exploit Released Online for SAP Solution Manager Flaw
Cybersecurity researchers have warned of a publicly available fully-functional exploit that could be used to target SAP enterprise software. The exploit leverages a vulnerability, tracked as CVE-2020-6207, that stems from a missing authentication check in SAP Solution Manager SolMan version 7.2 S...
CVE-2020-27653
CVE-2020-27653 affects Synology SRM (SRM 1.2.x) via QuickConnect. Talos documents an information-disclosure/mitm scenario where an attacker downgrades the VPN/HTTPS channel from HTTPS to HTTP, enabling interception of web traffic and session cookies. Affected versions include SRM 1.2.3 RT2600ac a...