103 matches found
CVE-2021-39864
Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier and 2.3.7p1 and earlier are affected by a cross-site request forgery CSRF vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to...
CVE-2021-39864
Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier and 2.3.7p1 and earlier are affected by a cross-site request forgery CSRF vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to...
Cross site request forgery (csrf)
Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier and 2.3.7p1 and earlier are affected by a cross-site request forgery CSRF vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to...
CVE-2021-39864
CVE-2021-39864 is a CSRF vulnerability in Adobe Commerce / Magento Open Source via a Wishlist Share Link. Affected: Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier, 2.3.7p1 and earlier. Impact: unauthenticated attacker could cause unauthorized additions to a customer’s cart withou...
Nextcloud: Folder architecture and Filesizes of private file drop shares can be getten
Steps To Reproduce: 1. Create a new Folder "TestABC" 2. Share a password protected link of this folder 3. Create a file "README.md" and a file "README.md" in the Subfolder "Subfolder". == curl -H "OCS-APIREQUEST: true" "http://localhost/ocs/v2.php/apps/text/public/workspace?shareToken=ABCDE12345"...
ownCloud 信息泄露漏洞
Owncloud ownCloud is a personal cloud storage solution from US-based ownCloud Owncloud. An information disclosure vulnerability exists in ownCloud Server that stems from a generated error message containing sensitive information. An attacker could trigger the error by appending certain characters...
Security update for nextcloud (important)
openSUSE Security Update: Security update for nextcloud Announcement ID: openSUSE-SU-2021:1068-1 Rating: important References: 1181445 1181803 1181804 1188247 1188248 1188249 1188250 1188251 1188252 1188253 1188254 1188255 1188256 Cross-References: CVE-2020-8293 CVE-2020-8294 CVE-2020-8295...
CVE-2021-32741
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in...
Code injection
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in...
CVE-2021-32741 Lack of ratelimit on public share link mount endpoint
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in...
CVE-2021-32515
Directory listing vulnerability in sharelink in QSAN Storage Manager allows attackers to list arbitrary directories and further access credential information. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...
CVE-2021-32517
Improper access control vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files using particular parameter in download function. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...
CVE-2021-32516
Path traversal vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...
Path traversal
Path traversal vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...
CVE-2021-32516
Path traversal vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...
CVE-2021-32517
Improper access control vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files using particular parameter in download function. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...
QSAN Storage Manager 安全漏洞
QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A directory traversal vulnerability exists in sharelink in QSAN Storage Manager 3.3.1 and earlier versions. An attacker could use this vulnerability to list arbitrary directories and further access...
QSAN Storage Manager 安全漏洞
QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. An improper access control vulnerability exists in sharelink in QSAN Storage Manager 3.3.1 and earlier versions. A remote attacker could exploit this vulnerability to download arbitrary files via specific...
CVE-2020-12848
In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password a...