Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Stored-Cross-Site-Scripting

CVE-2021-46078 漏洞名称：Vehicle Service Management System - '多处'文件上传导致存储型跨站脚本攻击 漏洞作者：SANU P.L CVE：CVE-2021-46078 CVSS：4.8 中危 参考链接： https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-stored-cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2021-46078...

Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Code-Execution

CVE-2021-46076 エクスプロイトタイトル: Vehicle Service Management System - 複数のファイルアップロードによるコード実行 エクスプロイト作成者: SANU P.L CVE: CVE-2021-46076 CVSS: 8.8 HIGH 参考文献: https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-code-execution https://nvd.nist.gov/vuln/detail/CVE-2021-46076...

Vehicle-Service-Management-System-Multiple-Cross-Site-Request-Forgery-CSRF-Leads-to-XSS

CVE-2021-46080 漏洞利用标题：车辆服务管理系统 - “多个”跨站请求伪造（CSRF）导致存储型跨站脚本（XSS） 漏洞利用作者：SANU P.L CVE：CVE-2021-46080 CVSS：4.8 中危 参考链接： https://www.plsanu.com/vehicle-service-management-system-multiple-cross-site-request-forgery-csrf-leads-to-stored-cross-site-scripting-xss...

Vehicle-Service-Management-System-User-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46073 エクスプロイトタイトル: Vehicle Service Management System - ユーザーリストにおける格納型クロスサイトスクリプティング XSS エクスプロイト作成者: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIUM 参考文献: https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss...

Vehicle-Service-Management-System-Settings-Stored-Cross-Site-Scripting-XSS

CVE-2021-46074 エクスプロイトのタイトル: Vehicle Service Management System - '設定' 保存型クロスサイトスクリプティング XSS エクスプロイト作成者: SANU P.L CVE: CVE-2021-46074 CVSS: 4.8 MEDIUM 参考文献: https://www.plsanu.com/vehicle-service-management-system-settings-stored-cross-site-scripting-xss...

Vehicle-Service-Management-System-Mechanic-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46069 エクスプロイトタイトル: Vehicle Service Management System - 'Mechanic List' Stored Cross Site Scripting XSS エクスプロイト作者: SANU P.L CVE: CVE-2021-46069 CVSS: 4.8 中 参考文献: https://www.plsanu.com/vehicle-service-management-system-mechanic-list-stored-cross-site-scripting-xss...

CVE-2026-56599: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery CSRF, session hijacking via...

CVE-2026-56589: Improper Neutralization of Input During Web Page Generation

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data...

CVE-2026-67105: Cleartext Transmission of Sensitive Information

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle MitM attacks...

CVE-2026-67104: Exposure of Sensitive Information to an Unauthorized Actor

HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation...

CVE-2026-67106: Exposure of Sensitive Information to an Unauthorized Actor

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks...

PT-2026-103900

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle MitM attacks...

Atlassian Jira Service Management Data Center and Server 10.0.x < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16759)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16759 advisory. - In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. Thi...

Security Bulletin: IBM Jazz for Service Management is affected by improper neutralization of input and incomplete authorization vulnerabilities in Apache ActiveMQ

Summary IBM Jazz for Service Management is affected by improper neutralization of input and incomplete authorization vulnerabilities in Apache ActiveMQ CVE-2026-42253, CVE-2026-46605 Vulnerability Details CVEID:CVE-2026-42253 DESCRIPTION: Improper Neutralization of Input During Web Page Generatio...

Atlassian Jira Service Management Data Center and Server 10.0.x < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16751)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16751 advisory. - In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and UR...

Atlassian Jira Service Management Data Center and Server 10.0.x < 10.3.18 / 10.4.x < 11.3.10 (JSDSERVER-16727)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16727 advisory. - node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter ...

Atlassian Jira Service Management Data Center and Server 5.15.2 < 10.3.24 / 10.4.x < 11.3.7 (JSDSERVER-16596)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16596 advisory. - Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validatio...

CVE-2026-21806

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

EUVD-2026-82876

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

CVE-2026-21806 HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...