4042 matches found
UBUNTU-CVE-2020-1946
In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...
Clario: Google API key leaks and security misconfiguration leads Open Redirect Vulnerability
Summary: Hello, when i search your targets and javascript files I found an googleapikey leaks in url = https://account.clario.co/js/main.044af6485f6b0cd90809.js. Part of the leak down below; 'https://firebasedynamiclinks.googleapis.com/v1/shortLinks?key=AIzaSyAw-SpLHVTIP3IFEIkckCuEmIhnUrY9OrQ';...
SRC-2021-0012 : Microsoft Exchange Server ImportTransportRuleCollection ProcessE15Format Remote Code Execution Vulnerability (patch bypass)
Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exchange Server. Authentication with the “Records Management” role is required to exploit this vulnerability. The specific flaw exists within the processing of the...
Arbitrary Code Injection
Apache SpamAssassin is vulnerable to arbitrary code injection. A local user is able to inject arbitrary code in the meta rule syntax...
Media Library Assistant < 2.90 - Authenticated Blind SQL Injection
The Media Library Assistant WordPress plugin was affected by an authenticated admin+ blind SQL injection vulnerability when there is at least one Custom Field Rule set in the plugin's options. PoC There need to be at least one Custom Field Rule in the plugin Custom Fields settings...
Media Library Assistant < 2.90 - Authenticated Blind SQL Injection
The Media Library Assistant WordPress plugin was affected by an authenticated admin+ blind SQL injection vulnerability when there is at least one Custom Field Rule set in the plugin's options. There need to be at least one Custom Field Rule in the plugin Custom Fields settings...
CVE-2020-6879
Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule...
PT-2020-19289
Name of the Vulnerable Software and Affected Versions ZXHN Z500 versions 1.0.0.2B1.1000 through 1.0.0.2B1.1000 ZXHN F670L version 1.1.10P1N2E Description Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The...
Unspecified vulnerability in Aviatrix Controller (CNVD-2021-17716)
Aviatrix Controller is a centralized control panel for orchestrating and managing various network and connectivity solutions. A sudo rule insecurity vulnerability exists in Aviatrix Controller versions prior to R5.4.1290. An attacker could execute all commands as any user on the system through th...
CVE-2020-26548
An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system...
CVE-2020-26548
An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system...
Design/Logic Flaw
An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system...
CVE-2020-26548
Aviatrix Controller (pre-R5.4.1290) contains an insecure sudo rule that allows a user to execute any command as any user on the system. This vulnerability affects Controller versions before R5.4.1290 and is supported by multiple sources (e.g., CNVD-2021-17716; NVD CVE-2020-26548) with high impact...
CVE-2020-26548
An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system...
CVE-2020-26548: Undefined Security Weakness
An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system...
PT-2020-16451
Name of the Vulnerable Software and Affected Versions Aviatrix Controller versions prior to R5.4.1290 Description An issue was discovered in Aviatrix Controller where there is an insecure sudo rule, allowing a user to execute all commands as any user on the system. Recommendations For Aviatrix...
Aviatrix Systems Controller 安全漏洞
Aviatrix Controller is a centralized control panel for orchestrating and managing various network and connectivity solutions. A sudo rule insecurity vulnerability exists in Aviatrix Controller versions prior to R5.4.1290. An attacker could execute all commands as any user on the system through th...
Pegasystem Pega Platform Cross-Site Scripting Vulnerability (CNVD-2020-63481)
Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. A cross-site scripting vulnerability...