30 matches found
CVE-2021-32703 Lack of ratelimit on shareinfo endpoint
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13,...
NewStart CGSL CORE 5.05 / MAIN 5.05 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0093)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has thunderbird packages installed that are affected by multiple vulnerabilities: - When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially...
CVE-2019-19797
An out-of-bounds write flaw was found in transfig in the way the fig2dev program handled the processing of Fig format files. Specifically, the flaw affects the translation process of Fig codes into the box graphics language. This flaw allows for potential exploitation by crashing the fig2dev...
ShopEx最新版多处SQL注射
简要描述： 不知道我有不有搞错，但已经尽量下载了最新版了。。。 在很多地方测试都存在。。。 ShopEx最新版多处SQL注射 详细说明： 我很怀疑自己是不是搞错呢。。。 注射1： http://127.0.0.1:5656/shopex/api.php POST act=searchsubregions&apiversion=1.0&returndata=string&pregionid=22 and select 1 fromselect count,concat0x7c,select Select version from informationschema.tables limit...
http-unsafe-output-escaping NSE Script
Spiders a website and attempts to identify output escaping problems where content is reflected back to the user. This script locates all parameters, ?x=foo&y=bar and checks if the values are reflected on the page. If they are indeed reflected, the script will try to insert ghzhzx"zxc'xcv and chec...
Cisco WLSE and HSE devices contain hardcoded username and password
Overview A default account with a common username and password exists in two Cisco products. An attacker with knowledge of this account information can compromise any of these devices on the network. Description A default account with a known, fixed username and password combination exists in som...
Sambar Server 5.x - Information Disclosure
source: https://www.securityfocus.com/bid/7207/info An information disclosure vulnerability has been reported for Sambar Server. The vulnerability exists in some files existing in Sambar Server's cgi-bin directory. An attacker can exploit this vulnerability by making a request for these files. Th...
Air Messenger LAN Server (AMLServer) stores usernames and passwords in plaintext
Overview Air Messenger LAN Server AMLServer stores usernames and passwords in plaintext. Description AMLServer for windows is a paging gateway that allows users on a TCP/IP LAN to communicate with mobile devices such as phones and pagers. Access to AMLServer's services is protected by a user...