CVE-2022-0861

The CVE-2022-0861 entry describes a XML External Entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) versions prior to 5.10 Update 13. A remote administrator can upload a crafted XML file via the extension import functionality, with impact limited to some leakage of confidential ...

CVE-2022-26521

Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the CatalogMedia ManagerImages settings can be changed by an administrator e.g., by configuring .php to be a valid image file type...

GitLab Enterprise Edition 和 GitLab Community Edition 信息泄露漏洞

GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. An information disclosure vulnerability exists in GitLab Enterprise Edition and GitLab Community Edition that could allow a remote administrator to gain...

F5 BIG-IQ Access Control Error Vulnerability (CNVD-2022-26842)

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and web services across public and private clouds, traditional data centers, and hybrid environments.An access control error vulnerability exists in the F5 BIG-IQ...

F5 BIG-IQ 访问控制错误漏洞

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and web services across public and private clouds, traditional data centers, and hybrid environments.An access control error vulnerability exists in the F5 BIG-IQ...

McAfee Network Security Manager 跨站脚本漏洞

McAfee Network Security Manager NSM is a network security solution from McAfee, Inc. that enables real-time monitoring of deployed McAfee Intrusion Prevention Systems throughout a network. A cross-site scripting vulnerability exists in McAfee Network Security Manager NSM versions prior to 10.1...

CVE-2021-31850

A denial-of-service vulnerability in Database Security DBS prior to 4.8.4 allows a remote authenticated administrator to trigger a denial-of-service attack against the DBS server. The configuration of Archiving through the User interface incorrectly allowed the creation of directories and files i...

Mcafee Database Security Server 安全漏洞

Mcafee Database Security Server is a database security software from Mcafee USA. The software provides users with a holistic view of their databases and the corresponding security status, protecting business-critical databases from external, internal and insider database threats in real time. A...

Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites

We have been tracking a campaign involving the SpyAgent malware that abuses well-known remote access tools RATs for some time now. While previous versions of the malware have been covered by other researchers, our blog entry focuses on the malicious actor’s latest attacks...

CVE-2021-25878

AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator...

Mcafee McAfee Data Loss Prevention SQL注入漏洞

Mcafee McAfee Data Loss Prevention DLP is a data loss prevention suite from McAfee, Inc. that includes components such as McAfee DLP Monitor, McAfee DLP Endpoint, and provides event management and reporting, synchronization of local and cloud DLP policies, and more. A SQL injection vulnerability ...

NETGEAR 安全漏洞

GC108P and other smart switch products from Netgear, U.S.A. Several of Netgear's smart switches are vulnerable to an input validation error, which stems from a failure of the daemon to check for validation when an authentication TLV is missing from an incoming NSDP packet. An unauthenticated...

Cisco Identity Services Engine 跨站脚本漏洞

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform regulates the network by collecting real-time information from the network, users, and devices to develop and enforce policies. A cross-site scripting...

CVE-2021-20761

Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker with an administrative privilege to alter the data of E-mail without the appropriate privilege...

CVE-2021-31731

A directory traversal issue in KiteCMS 1.1.1 allows remote administrators to overwrite arbitrary files via ../ in the path parameter to index.php/admin/Template/fileedit, with PHP code in the html parameter...

Magento Commerce 和 Magento Open Source代码问题漏洞

Magento Open Source is to provide basic e-commerce functionality that allows you to build unique online stores from scratch.Magento Commerce is to provide a best-in-class shopping experience without the need for developer support. A code issue vulnerability exists in Magento Commerce and Magento...

Magento Commerce 安全漏洞

Magento Commerce is to provide a best-in-class shopping experience without the need for developer support. A security vulnerability exists in Magento Commerce, which exists due to incorrect input validation when processing XML data. A remote administrator can pass specially crafted XML data to th...

Tenable Network Security Nessus 代码问题漏洞

Tenable Network Security Nessus is an open source system vulnerability scanner from US-based Tenable Network Security. A code issue vulnerability exists in Nessus Agent, which stems from the program's insufficient validation of files during file uploads, allowing a remote administrator user to...

CVE-2021-31832

Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention DLP Endpoint for Windows prior to 11.6.200 allows a remote ePO DLP administrator to inject JavaScript code into the alert configuration text field. This JavaScript will be executed when an end user...

Adobe Magento 授权问题漏洞

Adobe Magento is the United States of America Odobie Adobe company's set of open source PHP e-commerce system . The system provides features such as rights management, search engine and payment gateway. Adobe Magento suffers from an authorization issue vulnerability. The vulnerability is due to...