CVE-2021-26795

A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management...

CVE-2021-31853

DLL Search Order Hijacking Vulnerability in McAfee Drive Encryption MDE prior to 7.3.0 HF2 7.3.0.183 allows local users to execute arbitrary code and escalate privileges via execution from a compromised folder...

Cloudera Manager 跨站脚本漏洞

Cloudera Manager is an end-to-end application for managing CDH clusters.Cloudera Manager versions 5., 6., 7.1., 7.2., and 7.3. contain a cross-site scripting vulnerability. An attacker could use this vulnerability to launch an xss attack...

Cloudera Manager 跨站脚本漏洞

Cloudera Manager is an end-to-end application for managing CDH clusters.Cloudera Manager versions 5., 6., 7.1., 7.2., and 7.3. are vulnerable to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to conduct cross-site scripting attacks via path parameters...

CVE-2021-20702

Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. WordPress Delete All Comments Easily plugin in version 1.3 and earlier is vulnerable to cross-site request forgery, which can ...

CVE-2021-38474

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may allow an attacker to execute a brute-force password attack with no time limitation and without harming the normal operation of the user. Th...

McAfee Drive Encryption 安全漏洞

Mcafee McAfee Drive Encryption is a full-disk encryption software from McAfee, Inc. that helps protect data on Microsoft Windows tablets, laptops, and desktop PCs against loss of sensitive data, especially loss due to device loss or theft. A security vulnerability exists in the Windows system...

CVE-2021-35205

NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector...

Netscout NgeniusOne 安全漏洞

nGeniusONE is a service assurance solution provided by NETSCOUT that provides full visibility into infrastructure, interdependencies, and applications. nGeniusONE version 6.3.0 build 1196 contains an authorization bypass vulnerability in FDSQueryService. An attacker could exploit this vulnerabili...

IBM Security Guardium 信息泄露漏洞

IBM Security Guardium is a comprehensive data protection solution that provides full data security capabilities from compliance support to dynamic data masking. an information disclosure vulnerability exists in IBM Security Guardium version 11.3. An attacker could exploit the vulnerability to...

PT-2021-16151 · WordPress · Visual Link Preview

Name of the Vulnerable Software and Affected Versions: Visual Link Preview WordPress plugin versions prior to 2.2.3 Description: The issue allows any authenticated user to call several AJAX actions without proper authorization, due to the CSRF nonce being displayed for all authenticated users. Th...

@enonic/semantic-ui-react-form (>=2.1.0 <=2.3.0) potentially affected by CVE-2021-23440 via set-value (=4.0.0)

set-value NPM version =4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on set-value and may be impacted: - @enonic/semantic-ui-react-form =2.1.0, =2.3.0 Source cves: CVE-2021-23440 Source advisory: OSV:GHSA-4JQC-8M5R-9RPR...

Arista Networks MOS 安全漏洞

Arista Networks MOS is a fully programmable and highly modular Linux-based network operating system from Arista Networks, Inc. that uses the familiar industry-standard CLI and runs a single binary software image within the Arista switching family. A security vulnerability exists in the Arista...

PT-2021-5346 · Php +2 · Php +2

Name of the Vulnerable Software and Affected Versions: PHP versions 7.3.x through 7.3.30 PHP versions 7.4.x through 7.4.23 PHP versions 8.0.x through 8.0.10 Description: The issue arises from the incorrect restriction of the path name to a directory with limited access in the ZipArchive::extractT...

CVE-2021-27663

A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authorization. This issue affects: Johnson Controls CEM Systems AC2000 10.1; 10.2; 10.3; 10.4; 10.5...

Nuishop SQL注入漏洞

Nuishop is an application software. An application shopping center system. Nuishop version 2.3 suffers from a SQL injection vulnerability that can be exploited by an attacker who can include "/goods/getGoodsListByConditions/" in...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE that stems from improper...

PT-2021-10242 · Libav · Libav

Name of the Vulnerable Software and Affected Versions: Libav version 12.3 Description: The issue is a heap-based buffer over-read in the vc1 decode b mb intfi function in vc1 block.c, which can be exploited by an attacker to cause a denial-of-service via a crafted file. Recommendations: For Libav...

CVE-2021-38710

Static Persistent XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script. An attacker can store XSS in the database through the vulnerable SITENAME parameter...