299 matches found
Command injection
Stormshield Network Security SNS before 4.2.2 allows a read-only administrator to gain privileges via CLI commands...
CVE-2021-28962
The CVE-2021-28962 entry applies to Stormshield Network Security (SNS) prior to version 4.2.2. A command-injection vulnerability exists that lets a read-only administrator gain elevated privileges by issuing crafted CLI input. Affected product/versions: SNS before 4.2.2. Impact: attackers with re...
CVE-2021-28096
An issue was discovered in Stormshield SNS before 4.2.3 when the proxy is used. An attacker can saturate the proxy connection table. This would result in the proxy denying any new connections...
Code injection
An issue was discovered in Stormshield SNS before 4.2.3 when the proxy is used. An attacker can saturate the proxy connection table. This would result in the proxy denying any new connections...
CVE-2021-28096
An issue was discovered in Stormshield SNS before 4.2.3 when the proxy is used. An attacker can saturate the proxy connection table. This would result in the proxy denying any new connections...
CVE-2021-28096
Stormshield SNS prior to 4.2.3 (in proxy mode) is affected by CVE-2021-28096. An attacker can saturate the proxy connection table, resulting in the proxy denying any new connections. The description specifies the vulnerability as an overload of the proxy connection table but does not provide conc...
CVE-2021-45885
Stormshield Network Security (SNS) versions 4.2.2–4.2.7 are affected by a password handling issue where the first SSH password change does not properly clear the old password during a specific update-migration scenario. This can impact confidentiality (as per CVSS 3.1 base score 7.5) and is mitig...
CVE-2021-45885
An issue was discovered in Stormshield Network Security SNS 4.2.2 through 4.2.7 fixed in 4.2.8. Under a specific update-migration scenario, the first SSH password change does not properly clear the old password...
CVE-2021-41280
Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...
CVE-2021-41280
Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...
Command injection
Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...
CVE-2021-41280 OS command injection in Sharetribe Go
Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...
CVE-2021-41280
CVE-2021-41280 affects Sharetribe Go (OS configuration) where an operating system command injection is possible in affected versions that do not configure the secret SNS notification token via the sns_notification_token parameter. The issue is mitigated by upgrading to version 10.2.1, where the p...
Sharetribe Go 操作系统命令注入漏洞
Sharetribe Go is a source-available marketplace software from the Sharetribe team. An OS command injection vulnerability exists in versions of Sharetribe Go prior to 10.2.1, users who are unable to upgrade should set the snsnotificationtoken configuration parameter to a confidential value...
Discourse 2.8.x < 2.8.0.beta7 RCE Vulnerability
Discourse is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Critical RCE Vulnerability in Discourse
Discourse—an open source discussion platform—has released a security advisory to address a critical remote code execution RCE vulnerability CVE-2021-41163 in Discourse versions 2.7.8 and earlier. CISA urges developers to update to patched versions 2.7.9 or later or apply the necessary workarounds...
CVE-2020-21725
OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the pid parameter...
嘉兴想天信息科技 OpenSNS SQL注入漏洞
OpenSNS is a comprehensive social software developed by Thinking Sky. A SQL blind injection vulnerability exists in the pid parameter in /Controller/ChinaCityController.class.php in OpenSNS version 6.1.0. An attacker can exploit this vulnerability to obtain sensitive database information...
Advisory ROSA-SA-2021-1813
Software: clamav 0.102.4 OS: Cobalt 7.9 CVE-ID: CVE-2021-1386 CVE-Crit: HIGH CVE-DESC: A vulnerability in the Dynamic Link Library DLL loading mechanism in Cisco Advanced Malware Protection AMP for Windows Connector endpoints, ClamAV for Windows, and Immunet could allow an authenticated local...