EulerOS Virtualization for ARM 64 3.0.2.0 : perl-XML-LibXML (EulerOS-SA-2021-2094)

According to the version of the perl-XML-LibXML package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code...

The vulnerability of the cmd_subsys.php component of the Nagios Fusion software, a visualization tool for IT infrastructure monitoring, allows a attacker to escalate their privileges or execute arbitrary code with root rights.

The vulnerability of the cmdsubsys.php component of the Nagios Fusion software, a visualization tool for IT infrastructure monitoring, is related to the lack of measures for cleaning input data. Exploiting this vulnerability can allow an attacker to increase their privileges or execute arbitrary...

CVE-2021-27660

An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs...

CVE-2021-27660

An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs...

Design/Logic Flaw

An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs...

CVE-2021-27660

CVE-2021-27660 affects Johnson Controls C-CURE 9000. The vulnerability arises from an insecure client auto-update feature (improper input validation CWE-20) that can enable remote execution of lower-privileged Windows programs. Impact is high (C/H/I/H/A/H) with network vector and low attack compl...

CVE-2021-27660 C-CURE 9000

An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs...

CVE-2021-27660

An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs...

PT-2021-3508

Name of the Vulnerable Software and Affected Versions Django versions 3.1.x through 3.1.12 Django versions 3.2.x through 3.2.4 Description The issue is related to the QuerySet.order by function in the Django web application platform, which does not properly protect the SQL query structure. This...

Sensormatic Electronics C-CURE 9000 (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Equipment: C-CURE 9000 Vulnerability: Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original...

Wordpress Plugin XCloner 4.2.12 - Remote Code Execution (Authenticated)

Exploit Title: Wordpress Plugin XCloner 4.2.12 - Remote Code Execution Authenticated Date 30.06.2021 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://www.xcloner.com/ Software Link: https://downloads.wordpress.org/plugin/xcloner-backup-and-restore.4.2.12.zip Version: 4.2.1 - 4.2.12...

ArubaOS-Switch Ripple20 Multiple Vulnerabilities (ARUBA-PSA-2020-006)

The version of ArubaOS-Switch installed on the remote host is affected by multiple vulnerabilities in the Treck IP stack implementation. The vulnerabilities are collectively known as Ripple20, and can result in remote code execution, denial of service DoS, and information disclosure by remote,...

SQL Injection in Gogs

Multiple SQL injection vulnerabilities in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to 1 api/v1/repos/search, which is not properly handled in models/repo.go, or 2 api/v1/users/search, which is...

CVE-2021-31516

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 Build ID 88f343c3. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

The vulnerability of the Classyfrieds plugin, which allows for unlimited loading of dangerous types of files, enables attackers to load and execute arbitrary files.

The vulnerability of the Classyfrieds plugin is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to load and execute arbitrary files...

The vulnerability of FortiWeb web applications’ network firewalls arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This vulnerability allows attackers to execute arbitrary commands.

The vulnerability of FortiWeb web applications’ network firewalls exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely, using the SAML serve...

files_antivirus 操作系统命令注入漏洞

filesantivirus is a ClamAV-based ownCloud antivirus application. filesantivirus before 1.0.0 suffers from an operating system command injection vulnerability that allows remote users to execute arbitrary shell commands on the target system...

Exploit for Deserialization of Untrusted Data in Apache Tapestry

CVE-2021-27850 Exploit Overview CVE-2021-27850 is a...

BIOS Disconnect: New High-Severity Bugs Affect 128 Dell PC and Tablet Models

Cybersecurity researchers on Thursday disclosed a chain of vulnerabilities affecting the BIOSConnect feature within Dell Client BIOS that could be abused by a privileged network adversary to gain arbitrary code execution at the BIOS/UEFI level of the affected device. "As the attacker has the...

McAfee Active Response 安全漏洞

Mcafee McAfee Active Response MAR is an endpoint detection and response tool for security threats from McAfee USA. The product supports features such as quick access to threat data, threat alerts, and centralized management. A security vulnerability exists in McAfee Active Response that originate...