CVE-2021-20102

Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place...

SICK Visionary-S CX 加密问题漏洞

SICK Visionary-S CX is a 3D vision sensor from SICK, Germany. It provides direct output of color and depth values via Ethernet. The SICK Visionary-S CX has a security vulnerability in versions prior to 5.21.2.29154R, which can be exploited by an attacker with a weak password to more easily...

CVE-2021-25418

Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in specific condition...

CVE-2021-3569

A stack corruption bug was found in libtpms in versions before 0.7.2 and before 0.8.0 while decrypting data using RSA. This flaw could result in a SIGBUS bad memory access and termination of swtpm. The highest threat from this vulnerability is to system availability...

IMAGE CONQUEST DICOM SERVER 命令注入漏洞

IMAGE CONQUEST DICOM SERVER is IMAGE an open source application. It can store, validate, query and retrieve through programmable SQL database tables. A security vulnerability exists in CONQUEST DICOM SERVER before 1.5.0, which can be exploited by attackers to execute malicious code...

CVE-2021-24144

Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files...

CVE-2020-24448

Uncaught exception in some IntelR Graphics Drivers before version 15.33.51.5146 may allow an authenticated user to potentially enable denial of service via local access...

HPE Apollo 70 命令命令注入漏洞

The HPE Apollo 70 system is an Arm-based platform that provides the density and scalability required for large HPC cluster deployments. A command injection vulnerability exists in the libifc.so uploadsshkey function in the Baseboard Management Controller BMC firmware in HPE Apollo 70 versions pri...

PT-2020-18894 · Google +1 · Libprotobuf +1

Name of the Vulnerable Software and Affected Versions: Valve's Game Networking Sockets versions prior to v1.2.0 Description: The issue arises from improper handling of inlined statistics messages in the CConnectionTransportUDPBase::Received Data function, leading to an exception thrown from...

chromium-browser: Insufficient policy enforcement in extensions

Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension...

DrayTek Vigor3900, Vigor2960, and Vigor300B OS Command Injection Vulnerabilities (CNVD-2020-51416)

DrayTek Vigor3900 and others are products of DrayTek Taiwan, China.DrayTek Vigor3900 is a broadband router/VPN gateway appliance.Vigor2960 is a load-balancing router and VPN gateway appliance.Vigor300B is a load-balancing router. An operating system command injection vulnerability exists in DrayT...

WordPress Unauthorized Operation Vulnerability (CNVD-2020-29838)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Addons for Elementor is an extension plugin that uses one of the Elementor page builder plugins. A security vulnerability exis...

Grandstream UCM6200 SQL Injection Vulnerability

The Grandstream UCM6200 is an enterprise-class switch for IP telephony communications from Grandstream. A SQL injection vulnerability exists in the Grandstream UCM6200 series prior to version 1.0.20.22. The vulnerability stems from a database-based application that lacks validation of externally...

PYSEC-2020-162

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

CVE-2019-16210

Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save...

CVE-2019-3730

RSA BSAFE Micro Edition Suite versions prior to 4.1.6.3 in 4.1.x and prior to 4.4 in 4.2.x and 4.3.x, are vulnerable to an Information Exposure Through an Error Message vulnerability, also known as a “padding oracle attack vulnerability”. A malicious remote user could potentially exploit this...

CVE-2017-18529

The promobar plugin before 1.1.1 for WordPress has multiple XSS issues...

Johnson Controls Metasys system Trust Management Issues Vulnerability

Johnson Controls Metasys system is the United States Johnson Controls Johnson Controls company's set of building automation system. A trust management issue vulnerability exists in the Johnson Controls Metasys system prior to version 9.0, which arises from the Metasys ADS/ADX server and NAE/NIE/N...

PT-2019-19309 · 3S Smart · Codesys V3

Name of the Vulnerable Software and Affected Versions: 3S-Smart CODESYS V3 products versions prior to 3.5.14.20 Description: A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products, potentially resulting in a denial-of-service condition. The issu...

cPanel Information Disclosure Vulnerability (CNVD-2019-29715)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An information disclosure vulnerability exists in versions prior to cPanel 67.9999.103. The vulnerability stems from an error in...