888 matches found
CVE-2022-32480
Dell PowerScale OneFS, versions 9.0.0, up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an insecure default initialization of a resource vulnerability. A remote authenticated attacker may potentially exploit this vulnerability, leading to information disclosure...
Denial of Service in python-ldap
python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service ReDoS flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this...
CVE-2021-46823
python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service ReDoS flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this...
CVE-2022-26041
CVE-2022-26041 affects RCCMD 4.26 and earlier. A directory traversal vulnerability allows a remote authenticated attacker with administrative privileges to read or alter arbitrary files on the server via unspecified vectors. Red Hat and JVN entries corroborate the affected version range and confi...
Design/Logic Flaw
Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Commands which potentially leads to remote command execution vulnerability or denial of service DoS attack...
CVE-2022-27903
An OS Command Injection vulnerability in the configuration parser of Eve-NG Professional through 4.0.1-65 and Eve-NG Community through 2.0.3-112 allows a remote authenticated attacker to execute commands as root by editing virtualization command parameters of imported UNL files...
Eve-NG Professional 和 Eve-NG Community 操作系统命令注入漏洞
Eve-NG Professional is a clientless multi-vendor network emulation software. A security vulnerability exists in Eve-NG Professional version 4.0.1-65 and earlier, Eve-NG Community version 2.0.3-112 and earlier, which stems from a command injection vulnerability in the operating system in the...
Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream
Summary Multiple vulnerabilities in XStream that is used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2021-39145 DESCRIPTION: XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization...
Security Bulletin: A vulnerability in Samba affects IBM Spectrum Scale SMB protocol access method (CVE-2020-25717)
Summary A Samba vulnerability affects IBM Spectrum Scale SMB protocol access method that could allow remote authenticated attacker to gain elevated privileges . Vulnerability Details CVEID: CVE-2020-25717 DESCRIPTION: Samba could allow a remote authenticated attacker to gain elevated privileges o...
Security Bulletin: IBM SPSS Analytic Server is vulnerable to LDAP Injection (CVE-2021-39031)
Summary IBM SPSS Analytic Server uses IBM WebSphere Application Server Liberty. An LDAP injection vulnerability in IBM WebSphere Application Server Liberty has been addressed Vulnerability Details CVEID: CVE-2021-39031 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through...
Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM Tivoli Netcool Impact (CVE-2021-39031)
Summary IBM WebSphere Liberty is shipped as a component of IBM Tivoli Netcool Impact. Information about a security vulnerability affecting IBM WebSphere Liberty has been published in a security bulletin. Vulnerability Details CVEID: CVE-2021-39031 DESCRIPTION: IBM WebSphere Application Server -...
CVE-2022-22331
IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 219130...
Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Pak for Data System 1.0
Summary Apache Log4j used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2022-23302 Vulnerability Details CVEID:CVE-2022-23302 DESCRIPTION: Apache Log4j could allow a remote authenticated attacker to execute arbitrary code on the syste...
Watchguard WatchGuard Firebox 安全漏洞
Watchguard WatchGuard Firebox is a US-based Watchguard company that provides a comprehensive range of Internet security services, from traditional IPS and GAV to Web site/application control and malicious software prevention. A security vulnerability exists in WatchGuard Firebox that allows a...
Cross-site Scripting (XSS)
github.com/grafana/grafana is vulnerable to cross-site scriptingXSS attacks. A remote authenticated attacker is able to inject HTML content through the Grafana datasource or the plugin proxy and trick a user to visit a malicious HTML page using a specially crafted link...
SMA1000 SNMP Null pointer exception bug in Net-SNMP vendor packet resulting in SNMP DoS
A Null pointer exception bug in Net-SNMP vendor 5.9.0 and earlier packet allows a remote authenticated attacker to cause SMA1000 SNMP Denial of Service DoS by an insufficient check of null pointer. CVE: N/A Last updated: Feb. 7, 2022, 6:09 p.m...
GitLab Enterprise Edition 访问控制错误漏洞
GitLab Enterprise Edition is a content management system. An Access Control Error vulnerability exists in GitLab Enterprise Edition and Gitlab Community Edition that stems from improperly restricted access. When a remote authenticated attacker is linked to an item in the vulnerability indicator...
CVE-2021-4088 Blind SQL injection in DLP ePO extension
SQL injection vulnerability in Data Loss Protection DLP ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server...
CVE-2022-0182
Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master...