CVE-2021-36123

An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on...

Design/Logic Flaw

An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on...

CVE-2021-36123

The CVE concerns Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is vulnerable to local file inclusion when processing remote input in the textFile parameter from an authenticated user. This allows reading arbitrary files on the server filesystem and any files a...

CVE-2021-33711

A vulnerability has been identified in Teamcenter Active Workspace V4 All versions V4.3.9, Teamcenter Active Workspace V5.0 All versions V5.0.7, Teamcenter Active Workspace V5.1 All versions V5.1.4. The affected application allows verbose error messages which allow leaking of sensitive informatio...

CVE-2021-33711

A vulnerability has been identified in Teamcenter Active Workspace V4 All versions V4.3.9, Teamcenter Active Workspace V5.0 All versions V5.0.7, Teamcenter Active Workspace V5.1 All versions V5.1.4. The affected application allows verbose error messages which allow leaking of sensitive informatio...

CVE-2021-33711

A vulnerability has been identified in Teamcenter Active Workspace V4 All versions V4.3.9, Teamcenter Active Workspace V5.0 All versions V5.0.7, Teamcenter Active Workspace V5.1 All versions V5.1.4. The affected application allows verbose error messages which allow leaking of sensitive informatio...

Siemens Teamcenter Active Workspace 跨站脚本漏洞

Siemens Teamcenter Active Workspace is a software application from Siemens Germany. A product lifecycle management software. A cross-site scripting vulnerability exists in Teamcenter Active Workspace that originates from a detailed error message in the affected application, which could disclose...

Echo ShareCare 安全漏洞

ShareCare is a clinical and financial software system from Echo Group. A security vulnerability exists in Echo ShareCare version 8.15.5 that stems from the TextReader function in General/TextReader/TextReader.cfm being susceptible to a local file inclusion vulnerability when processing remote inp...

jetty: Ambiguous paths can access WEB-INF

In Jetty the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can use this vulnerability to reveal sensitive information regarding the implementation of a web application...

MDT AutoSave SQL注入漏洞

MDT AutoSave is a software application. It provides an automated change management function. An SQL injection vulnerability exists in MDT AutoSave where a function in the device is used to retrieve process-specific system information, which is collected by executing multiple commands and...

Directory Traversal

Overview elFinder.AspNet is an elFinder ASP.NET backend Affected versions of this package are vulnerable to Directory Traversal. The user-controlled file name is not properly sanitized before it is used to create a file system path. PoC A test environment is within the GitHub repository and can b...

CVE-2021-34074

PandoraFMS =7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. To bypass the built-in protection, a relative path is used in the requests...

CVE-2021-27043

An Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to leverage the application to write in unexpected paths. In order to exploit this the attacker would need the victim to enable full page heap in the application...

CVE-2021-27043

An Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to leverage the application to write in unexpected paths. In order to exploit this the attacker would need the victim to enable full page heap in the application...

DEBIAN-CVE-2021-32708

Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The conditions are: A user is allowed to supply the...

UBUNTU-CVE-2021-32708

Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The conditions are: A user is allowed to supply the...

CVE-2021-0606

A flaw was found in the Linux kernel. The function drmsyncobjhandletofd first calls drmsyncobjfind which increments the refcount of the object on success. In all of the drmsyncobjhandletofd error paths, the refcount is decremented, but in the success path the refcount should remain at +1 as the...

Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows

PHPMailer 6.4.1 contains a possible remote code execution vulnerability through the $langpath parameter of the setLanguage method. If the $langpath parameter is passed unfiltered from user input, it can be set to a UNC path, and if an attacker is also able to create a remote mount on the server...

GHSA-7Q44-R25X-WM4Q Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows

PHPMailer 6.4.1 contains a possible remote code execution vulnerability through the $langpath parameter of the setLanguage method. If the $langpath parameter is passed unfiltered from user input, it can be set to a UNC path, and if an attacker is also able to create a remote mount on the server...

Cisco Webex Meetings DLL Injection (cisco-sa-webex-dll-inject-XNmcSGTU)

According to its self-reported version, Cisco Webex Meetings is affected by an dll injection vulnerability due to incorrect handling of directory paths at run time. An authenticated, local attacker can exploit this, by inserting a configuration file in a specific path in the system, to execute...