Path traversal

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in PDF Viewer component in Synology DiskStation Manager DSM before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors...

Synology Download Station 代码问题漏洞

Synology Download Station is a browser extension. It allows you to browse the Download Center suite of active and downloaded tasks and add tasks without accessing the web version of Synology. A server-side request forgery vulnerability exists in Synology Download Station before 3.8.15-3563, which...

Lasso 数据伪造问题漏洞

Lasso is an eBay open source Node.js-style JavaScript module bundler. The tool offers many different optimizations such as bundling, code splitting, delayed loading, conditional dependencies, and more. A security vulnerability exists in Lasso SAML, which is formed from improper privilege manageme...

CVE-2021-32539 Hundred Plus 101EIP - Stored XSS-1

Add event in calendar function in the 101EIP system does not filter special characters in specific fields, which allows remote authenticated users to inject JavaScript and perform a stored XSS attack...

CVE-2021-20517

IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to read and delete arbitrary files on the system. IBM X-Force ID: 198435...

CVE-2021-33510

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

SearchBlox File Inclusion Vulnerability

SearchBlox is an application from US-based SearchBlox, Inc. Provides a powerful enterprise search architecture for on-premise or cloud deployments. A security vulnerability exists in SearchBlox versions prior to 9.2.2 that allows remote, unauthenticated users to read arbitrary files from the...

Liferay DXP Denial of Service Vulnerability

Liferay DXP is a suite of digital experience collaboration platforms from Liferay USA. A security vulnerability exists in Liferay DXP versions prior to 7.3, which can be exploited by an attacker to prevent any user authentication from passing before remote authentication...

Sql injection

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to 1 CommerceChannelRelFinder.countByCC, or 2 CommerceChannelRelFinder.findByCC...

Liferay DXP 安全漏洞

Liferay DXP is a suite of digital experience collaboration platforms from Liferay USA. A security vulnerability exists in Liferay DXP versions prior to 7.3, which can be exploited by an attacker to prevent any user authentication from passing before remote authentication...

CVE-2021-32544

Special characters of IGT search function in igt+ are not filtered in specific fields, which allow remote authenticated attackers can inject malicious JavaScript and carry out DOM-based XSS Cross-site scripting attacks...

DEBIAN-CVE-2021-32056

Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall...

CVE-2021-32056

Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall...

CVE-2021-30171

Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

CVE-2021-29203

A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands,...

CVE-2021-29203

CVE-2021-29203 affects HPE Edgeline Infrastructure Manager prior to version 1.22. The connected Nuclei template documents an authentication bypass vulnerability that could be remotely exploited to bypass remote authentication, potentially allowing execution of arbitrary commands, gaining privileg...

PT-2021-18122

Name of the Vulnerable Software and Affected Versions: HPE Edgeline Infrastructure Manager versions prior to 1.22 Description: A security issue has been identified that could be remotely exploited to bypass remote authentication, leading to the execution of arbitrary commands, gaining privileged...

CVE-2021-29203: Missing Authentication for Critical Function

A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands,...

Hewlett Packard Enterprise Plugs Critical Bug in Edge Platform Tool

Hewlett Packard Enterprise HPE is urging customers to patch one of its premier edge application management tools that could allow an attacker to carry out a remote authentication bypass attack and infiltrate a customer’s cloud infrastructure. Join Threatpost for “Fortifying Your Business Against...

CVE-2021-31926

AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local system firewall by crafting an HTTPS request directly to the applicable API endpoint despite not having permission to make changes to the system's network...