10761 matches found
CVE-2021-41833
Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution...
CVE-2021-42002
Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution...
CVE-2021-42002
Affected software: Zoho ManageEngine ADManager Plus up to build 7114 (before 7.1 Build 7115). Vulnerability: A filter bypass enables an unauthenticated, remote attacker to upload a file and achieve remote code execution. Impact: Remote code execution with high severity (per CVE metrics). Root cau...
CVE-2021-41833
Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution...
CVE-2021-41833
Zoho ManageEngine Patch Connect Plus is affected by CVE-2021-41833. The vulnerability exists in Patch Connect Plus versions prior to 90099 and allows unauthenticated remote code execution. The CNVD entry confirms the same issue and notes exploitation by an unauthenticated attacker to achieve remo...
ZOHO ManageEngine ADAudit Plus 安全漏洞
Zoho ManageEngine ADAudit Plus is a web-based Active Directory change auditing and reporting solution. An arbitrary file write vulnerability exists in Zoho ManageEngine ADAudit Plus versions prior to 7006, which can be exploited by an attacker to write and execute arbitrary files on the system...
Zoho ManageEngine Patch Connect Plus 代码问题漏洞
Zoho ManageEngine Patch Connect Plus is a tool that leverages existing Microsoft System Center Configuration Manager servers to help deploy patches to over 250 third-party applications e.g., Adobe applications, Java and WinRAR. A remote code execution vulnerability exists in Zoho ManageEngine Pat...
CVE-2021-42847
Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files...
CVE-2021-42847
Product affected: ManageEngine ADAudit Plus, versions before 7006. Vulnerability: Arbitrary file write that enables authenticated users to write and execute files via the alert_script mechanism, enabling remote code execution (RCE) under the account running ADAudit Plus. Root cause / vector: Expl...
CVE-2020-23891
A User Mode Write AV in Editor+0x5cd7 of WildBit Viewer v6.6 allows attackers to cause a denial of service DoS via a crafted tiff file...
Softing Industrial Automation OPC 资源管理错误漏洞
Softing Industrial Automation OPC is a suite of OPC OLE for Process Control solutions from Softing Industrial Automation, Germany. A security vulnerability exists in the Softing Industrial Automation OPC UA c++ SDK that originates from a remote attacker who can exploit the vulnerability to cause ...
WordPress Plugin Cross-Site Request Forgery Vulnerability (CNVD-2021-92549)
WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. access control error vulnerability in Wordpress...
Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus
Microsoft has detected exploits being used to compromise systems running the ZOHO ManageEngine ADSelfService Plus software versions vulnerable to CVE-2021-40539 in a targeted campaign. Microsoft Threat Intelligence Center MSTIC attributes this campaign with high confidence to DEV-0322, a group...
Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus
Microsoft has detected exploits being used to compromise systems running the ZOHO ManageEngine ADSelfService Plus software versions vulnerable to CVE-2021-40539 in a targeted campaign. Microsoft Threat Intelligence Center MSTIC attributes this campaign with high confidence to DEV-0322, a group...
Security Researchers Reveal Activity Targeting ManageEngine ADSelfService Plus
On September 16, CISA released a joint alert on exploitation of a vulnerability CVE-2021-40539 in ManageEngine ADSelfService Plus. On November 8, security researchers from Palo Alto Networks and Microsoft Threat Intelligence Center MSTIC released separate reports on targeted attacks against...
CVE-2021-24801
The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site...
Cross site scripting
The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site...
CVE-2021-24801
The CVE CVE-2021-24801 affects the WordPress plugin WP Survey Plus up to version 1.0 . The vulnerability arises from missing authorization checks and absent CSRF protections in the plugin’s AJAX actions, allowing any user to call the actions to add/edit/delete surveys . Additionally, inadequate s...
Wordpress plugin WP Survey Plus 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. access control error vulnerability in Wordpress...
