CVE-2021-44088

An SQL Injection vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows a remote attacker to bypass authentication via unsanitized login parameters...

CVE-2022-26500

CVE-2022-26500 affects Veeam Backup & Replication and relates to an improper limitation of path names in internal API functions, enabling a remote, authenticated user to upload and execute arbitrary code. Affected product range includes 9.5U3/U4, 10.x, and 11.x. The root cause is exposure of inte...

CVE-2021-44261

A vulnerability is in the 'BRStop.html' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any authentication. When processed, it exposes firmware version information for the device...

CVE-2021-45791

Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/membertype.php, /admin/modules/system/usergroup.php, and /admin/modules/membership/index.php through the dir parameter. It can be used by remotely authenticated librarian users...

CVE-2021-45791

Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/membertype.php, /admin/modules/system/usergroup.php, and /admin/modules/membership/index.php through the dir parameter. It can be used by remotely authenticated librarian users...

Microsoft Windows Security Account Manager 权限许可和访问控制问题漏洞

Microsoft Windows Security Account Manager is a Windows security account manager from Microsoft USA for storing user passwords. It can be used to authenticate local and remote users. Microsoft Windows Security Account Manager is vulnerable to privilege permission and access control issues. No...

Path traversal

Multiple authenticated remote path traversal vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch...

Design/Logic Flaw

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site...

PT-2025-45366

Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to 5.7.04 build 6425 Description The software contains a flaw within the SNMP management tool that permits remote attackers to circumvent authentication procedures and exploit a SQL injection issue. The SQL...

CVE-2020-27958

The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to provide crafted input in a job template...

HPESBST04255 rev.1 - HPE Fibre Channel and SAN Switches with Brocade Fabric OS (FOS) Prior to v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x, Remote Authentication Bypass

Potential Security Impact: Remote: Authentication Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE B-series SN6000B Fibre Channel Switch -Prior to v8.2.1C, v8.1.2h HPE B-series SN3600B Fibre Channel Switch -Prior to v8.2.1C, v8.1.2h HPE B-series SN4000B SAN Extension...

CVE-2022-22679

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in support service management in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote authenticated users to write arbitrary files via unspecified vectors...

Design/Logic Flaw

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in work flow management in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2021-43928

CVE-2021-43928 describes an OS command injection in Synology Mail Station’s mail sending/receiving component. The issue arises from improper neutralization of special elements, enabling remote authenticated users to execute arbitrary commands via unspecified vectors. Affected are Synology Mail St...

CVE-2021-29394

Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST...

3.0 bug fix update

An update is available for freeradius. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRADIUS is a high-performance and highly configurable free Remote...

The vulnerability of NETGEAR’s Wi-Fi router software, including models CBR750, CBR40, RBR852, RBR850, and RBS850, stems from deficiencies in authentication mechanisms. This allows attackers to circumvent security restrictions.

The vulnerability of NETGEAR Wi-Fi router software, including models CBR750, CBR40, RBR852, RBR850, and RBS850, is related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions from a remote location...

CVE-2021-34993

This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CVSearchService service. The issue results from the lack of proper...

Fortinet FortiAuthenticator 授权问题漏洞

Fortinet FortiAuthenticator, a centralized user identity management solution from Fortinet, Inc. is vulnerable to an authentication bypass vulnerability in version 6.4.0 due to improper design or implementation of the authentication module code. issue. An attacker could exploit this vulnerability...

CVE-2021-41025

Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using shared resource with improper synchronization and one of...