CVE-2019-11098

The CVE-2019-11098 entry relates to the EDK II MdeModulePkg, where insufficient input validation could allow an unauthenticated user to escalate privileges, cause a denial of service, or disclose information via physical access. Affected products/contexts in connected documents include edk2 packa...

WordPress plugin code injection vulnerability (CNVD-2021-52424)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . The WordPress plugin suffers from a code injection...

CVE-2021-24442

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the dateanswers POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks...

CVE-2021-36381

Edifecs Transaction Management is affected by CVE-2021-36381: an unauthenticated attacker can inject arbitrary text into a user’s browser via logon.jsp?logon_error= on the login screen. The vulnerability stems from insufficient input validation on that parameter (per CNNVD-202107-646), enabling i...

CVE-2021-26088

An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO firewall policy and access the protected network via sending specifically crafted UDP login notification packets...

WordPress 插件 SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . The WordPress plugin suffers from a code injection...

CVE-2021-35451

In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into user browser via the Web application...

CVE-2021-35451

In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into user browser via the Web application...

Code injection

In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into user browser via the Web application...

CVE-2021-35451

In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into user browser via the Web application...

IBM DB2 11.5 < 11.5.6 FP0 Multiple Vulnerabilities (UNIX)

According to its version, the installation of IBM DB2 running on the remote host is 11.5 prior to 11.5.6 FP0. It is, therefore, affected by multiple vulnerabilities including the following: - IBM DB2 is affected by a flaw which could allow an unauthenticated, local user to to access and change...

Atlassian Jira < 8.5.15 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.15, 8.6.x 8.13.7 or 8.14.x 8.17.0. It is, therefore, affected by multiple vulnerabilities: - A Cross-Site Scripting XSS vulnerability in the CardLayoutConfigTable componen...

CVE-2021-35336

Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an unauthenticated user to access a sensitive part of the system with a high privileged account...

CVE-2021-35336

Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an unauthenticated user to access a sensitive part of the system with a high privileged account...

CVE-2020-22172

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\getdoctor.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

Sql injection

In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gdpopularlocationlist did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues...

CVE-2020-24516

Modification of assumed-immutable data in subsystem in IntelR CSME versions before 13.0.47, 13.30.17, 14.1.53, 14.5.32, 15.0.22 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

CVE-2021-0097

Path traversal in the BMC firmware for IntelR Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable a denial of service via adjacent access...

CVE-2021-0101

Buffer overflow in the BMC firmware for IntelR Server BoardM10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable an escalation of privilege via adjacent access...

Privilege escalation

Modification of assumed-immutable data in subsystem in IntelR CSME versions before 13.0.47, 13.30.17, 14.1.53, 14.5.32, 15.0.22 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...