334 matches found
CVE-2021-36318
Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vulnerability, leading to a complete outage...
CVE-2020-4809
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633...
BookStack 跨站脚本漏洞
BookStack, a platform for storing and organizing information and documents, is vulnerable to a storage cross-site scripting vulnerability. An attacker could use this vulnerability to obtain administrator cookies, etc...
CMS Made Simple 跨站脚本漏洞
CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS Cmsms team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. CMS Made Simple CMSMS 2.2.14 suffers from a cross-si...
CVE-2021-36703
The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting XSS vulnerability. It allows remote attackers to send an authenticated post HTTP request to admin/config and inject arbitrary web script or HTML through a special website...
GitLab 跨站脚本漏洞
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab, which stems fr...
QNAP NAS 安全漏洞
Qnap Systems QNAP NAS running Multimedia Console is an application from China Weilian Qnap Systems. A Multimedia Console. A security vulnerability exists in QNAP NAS that stems from insecure storage of sensitive information in myQNAPcloud Link. The following products and versions are affected: QN...
ceph-dashboard: Don't use Browser's LocalStorage for storing JWT but Secure Cookies with proper HTTP Headers
A flaw was found in ceph-dashboard. The JSON Web Token JWT used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and...
The vulnerability of Google Chrome’s browser storage, related to the operation of pushing operations beyond the data buffer’s allowable limits, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of Google Chrome’s browser storage relates to the operation of operations that exceed the permissible data buffer limits. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...
OwnCloud Encryption Issues Vulnerabilities
OwnCloud OwnCloud is a personal cloud storage solution from OwnCloud Owncloud, an American company. An encryption issue vulnerability exists in OwnCloud. The vulnerability stems from a lock protection mechanism that can be bypassed by moving the system date/time to the past. No details of the...
Git Lfs Code Issue Vulnerability
Git Lfs is a command line tool from the Git Lfs team for working with large files in git projects. A security vulnerability exists in Git LFS that stems from allowing an attacker to execute arbitrary code...
CVE-2020-26199
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials including the Unisphere admin privilege user password is stored in a plain text in multiple log files. A local authenticated attacker with access to the l...
Default credentials
Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to u...
Default credentials
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials including the Unisphere admin privilege user password is stored in a plain text in a system file. A local authenticated attacker with access to the syste...
CVE-2020-8696
Improper removal of sensitive information before storage or transfer in some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...
CVE-2020-4650
IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023...
chromium-browser: Out of bounds read in storage
Heap buffer overflow in storage in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page...
Easergy Builder Hardcoded Encryption Key Plaintext Storage Vulnerability
Schneider Electric Easergy Builder is a set of configuration software for Easergy remote terminal units and controllers from Schneider Electric, France. A security vulnerability exists in Schneider Electric Easergy Builder version 1.4.7.2 and prior versions. An attacker could exploit the...
The vulnerability of the Ceph storage system, related to an authentication process error, allows a perpetrator to gain unauthorized access to the encryption keys for dm-crypt.
The vulnerability of the Ceph storage system is related to an authentication process error. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the encryption keys used for dm-crypt...