Design/Logic Flaw

Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow an unauthorized user to reconfigure, reset the device...

CVE-2021-3705

Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow an unauthorized user to reconfigure, reset the device...

CVE-2021-34580

In mymbCONNECT24, mbCONNECT24 = 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts...

CVE-2021-22239

An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later...

CVE-2021-22239

An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later...

CVE-2021-22239

CVE-2021-22239 affects GitLab CE/EE 14.0 and later, where an unauthorized user could insert metadata when creating a new issue. The connected advisories confirm the issue is an access-restriction bypass tied to issue creation, with multiple sources noting the need to upgrade to a patched release....

CVE-2021-22239

Removed by vendor...

PT-2021-6485 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.0 and later Description: The issue is related to the ability of an unauthorized user to insert metadata when creating a new issue. This allows a remote attacker to impact data integrity. Recommendations: For GitLab...

Advantech WebAccess/NMS Authorization Issue Vulnerability

Advantech WebAccess/NMS is a Web browser-based network management system NMS software package from Advantech, Taiwan, China.Advantech WebAccess/NMS is vulnerable to an authorization issue in versions prior to v3.0.3Build6299, which stems from the fact that the affected product has incorrect...

CVE-2021-32587

An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow a remote and authenticated attacker with restricted user profile to retrieve the list of administrative users of other ADO...

CVE-2021-22240

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled...

CVE-2021-20540

IBM Cloud Pak for Security CP4S 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198923...

Information disclosure

IBM Cloud Pak for Security CP4S 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198920...

Information disclosure

IBM Cloud Pak for Security CP4S 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198923...

Security Bulletin: A security vulnerability was fixed in IBM Security Access Manager and IBM Security Verify Access Docker containers

Summary A security vulnerability was fixed in IBM Security Access Manager and IBM Security Verify Access Docker containers Vulnerability Details CVEID: CVE-2021-20439 DESCRIPTION: IBM Security Access Manager Docker stores user credentials in plain clear text which can be read by an unauthorized...

CVE-2021-20439

IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by an unauthorized user...

Monitorr 1.7.6m Bypass / Information Disclosure / Shell Upload Exploit

!/usr/bin/env ruby Exploit Title: Monitorr exploit toolkit Google Dorks: inurl:/assets/config/installation/register.php?action=register Author: noraj Alexandre ZANNI for SEC-IT http://secit.fr Author website: https://pwn.by/noraj/ Exploit source: https://github.com/sec-it/monitorr-exploit-toolkit...

CVE-2021-21422 XSS Vulnerability in mongo-express

mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, howev...

YzmCMS Cross-Site Request Forgery Vulnerability (CNVD-2021-40496)

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture developed by Yuan Zhimeng alone. YzmCMS 5.8 version of the existence of cross-site request forgery vulnerability, the attacker can be member/member/add.html through the use of this vulnerability to add...

spice-vdagent: possible file transfer DoS and information leak via active_xfers hash map

A flaw was found in the SPICE file transfer protocol. File data from the host system can partially or fully end up in the client connection of an unauthorized local user in the VM system. Active file transfers from other users could also be interrupted, resulting in a denial of service. The highe...