Reolink RLC-410W Information Disclosure Vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China. reolink RLC-410W in v3.0.0.13620121102 is vulnerable to information disclosure, which stems from information disclosure due to web server configuration errors. An attacker could use this vulnerability to obtain sensitive information...

CVE-2021-44659

Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery SSRF. NOTE: the vendor's position is that the observed behavior is not a vulnerability, because the product's design allows an...

CVE-2021-44682

An issue 6 of 6 was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen on random .NET Remoting TCP ports for possible commands from client applications. These TCP services can be exploited due to deserialization...

CVE-2021-44679

The CVE-2021-44679 issue affects Veritas Enterprise Vault (up to version 14.1.2). The vulnerability arises during startup when Enterprise Vault launches multiple services that listen on random .NET Remoting TCP ports and on local IPC channels. The underlying problem is deserialization of untruste...

Improper file handling in concrete5/core

A bypass of adding remote files in Concrete CMS previously concrete5 File Manager leads to remote code execution in Concrete CMS concrete5 versions 8.5.6 and below. The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored ...

Redis Labs Redis 跨站脚本漏洞

Redis Labs Redis is an open source, ANSI C, network-enabled, memory-based, persistent logging, key-value Key-Value storage database from Redis Labs, Inc. that provides APIs in multiple languages. A cross-site scripting vulnerability exists in ASRedis versions prior to 0.5, which can be exploited ...

CVE-2020-28968

Draytek VigorAP 1000C contains a stored cross-site scripting XSS vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field...

Cross site scripting

Draytek VigorAP 1000C contains a stored cross-site scripting XSS vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field...

Draytek VigorAP 1000C 跨站脚本漏洞

DrayTek Corporation Draytek VigorAp is a wireless access point from DrayTek Corporation. The Draytek VigorAP 1000C suffers from a cross-site scripting vulnerability that stems from the software's lack of effective filtering and validation of user uploaded parameters in the RADIUS Settings - RADIU...

Twitch data breach resulted from server configuration error

By Deeba Ahmed Twitch Data Breach took place a couple of days ago when an anonymous hacker published a torrent file with 125 GB worth of data on the 4chan messaging board. This is a post from HackRead.com Read the original post: Twitch data breach resulted from server configuration error...

CVE-2021-41385

The third party intelligence connector in Securonix SNYPR 6.3.1 Build 1842950302 allows an authenticated user to obtain access to server configuration details via SSRF...

CVE-2021-41385

The third party intelligence connector in Securonix SNYPR 6.3.1 Build 1842950302 allows an authenticated user to obtain access to server configuration details via SSRF...

CVE-2021-41385

The third party intelligence connector in Securonix SNYPR 6.3.1 Build 1842950302 allows an authenticated user to obtain access to server configuration details via SSRF...

Design/Logic Flaw

The third party intelligence connector in Securonix SNYPR 6.3.1 Build 1842950302 allows an authenticated user to obtain access to server configuration details via SSRF...

CVE-2021-41385

The CVE-2021-41385 entry concerns Securonix SNYPR 6.3.1 Build 184295_0302, where a flaw in the third‑party intelligence connector allows an authenticated user to perform SSRF to access server configuration details. The description consistently states an SSRF path exploited by an authenticated use...

Securonix SNYPR 代码问题漏洞

Securonix SNYPR is an open, modular, next-generation security intelligence platform from Securonix, Inc. that combines log management, security information and events. A security vulnerability exists in Securonix SNYPR 6.3.1 Build 1842950302, which stems from a third-party intelligent connector i...

PT-2021-23285

Name of the Vulnerable Software and Affected Versions Securonix SNYPR version 6.3.1 Build 184295 0302 Description The issue allows an authenticated user to obtain access to server configuration details via Server-Side Request Forgery SSRF in the third party intelligence connector. Recommendations...

CVE-2021-41385: Server-Side Request Forgery (SSRF)

The third party intelligence connector in Securonix SNYPR 6.3.1 Build 1842950302 allows an authenticated user to obtain access to server configuration details via SSRF...

Security check skip in Apache Dubbo

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check when enabled and reaching a deserialization operation with native jav...

Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.

Impact Unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where: - the vulnerable homeserver is in the room; and - untrusted users are permitted to create groups communities. By defaul...