ZTE ZXHN H168N 信息泄露漏洞

The ZTE ZXHN H168N is a router from China's ZTE Corporation ZTE. The ZTE ZXHN H168N 3.5.0EG1T4TE suffers from an information disclosure vulnerability that originates from improper privilege settings, which can be exploited by an attacker with normal user privileges to obtain some sensitive user...

Logic flaws exist in the management informationization practical training cloud platform and financial management practical training cloud platform of Changjie Tong Information Technology Co.

Ltd. is a company dedicated to providing platform services, application services, and value-added data services centered on financial and management services for small and medium-sized enterprises in China. A logic flaw vulnerability exists in the Management Informationization Practical Training...

Esri Arcgis Server SQL Injection Vulnerability

Esri Arcgis Server is the United States Esri company's a Web-oriented can be used to provide geographic location services, enterprise-class software platform. A SQL injection vulnerability exists in ArcGIS Server version 10.8.1 and earlier versions, which can be exploited by attackers to obtain...

GHSA-RCP4-JM2V-MR3F Cross-site scripting in Shopizer

A stored cross-site scripting XSS vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customername in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when informati...

Guangxi Guitian Energy Group Company Limited Guitian Gas Mall System Logic Flaw Vulnerability

Guangxi Guitian Energy Group Co., Ltd. is the main LPG comprehensive service enterprise in Guangxi. The products cover: service system, cylinder traceability system. It involves many industries such as gas station, LNG filling station, industrial gas station, chemical polymer new material...

Esri Arcgis Server SQL注入漏洞

Esri Arcgis Server is the United States Esri company's a Web-oriented can be used to provide geographic location services, enterprise-class software platform. A SQL injection vulnerability exists in ArcGIS Server version 10.8.1 and earlier versions, which can be exploited by attackers to obtain...

U.S. General Services Administration: User information disclosed via API

Summary: It appears that the requests for "system accounts" are fully available via an API endpoint that does not require authentication. The main issue is that among the information disclosed are user emails many with gmail addresses but the individual applications also include information that...

Unspecified Vulnerability in Nextcloud (CNVD-2021-39030)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server that can be exploited by an attacker to access basic information about a server user by accessing a public...

CVE-2021-32656

Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added a...

Spoofing

Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added a...

CVE-2021-32656

Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added a...

PT-2021-19834 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 19.0.11 Nextcloud Server versions prior to 20.0.10 Nextcloud Server versions prior to 21.0.2 Description: A vulnerability in federated share exists in Nextcloud Server, allowing an attacker to gain access to...

OnePlus8T has an information leak vulnerability

The OnePlus 8T is a smartphone. OnePlus8T has an information disclosure vulnerability. An attacker can exploit to obtain sensitive user information...

Unauthorized Access Vulnerability in IoT Smart Water Meter Supervision Platform of Shandong KDE Electronics Co.

IOT Smart Water Meter Supervision Platform is a smart water meter monitoring platform developed by Shandong KD Electronics Co., Ltd. with the functions of water account opening, bill payment management, data reporting and water meter management. Ltd. There is an unauthorized access vulnerability ...

CVE-2021-33561

A stored cross-site scripting XSS vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customername in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when informati...

GHSA-Q9P8-33WC-H432 Authenticated users can exploit an enumeration vulnerability in Harbor

Impact Hidde Smit from Cyber Eagle has discovered an User Enumeration flaw in Harbor. The issue is present in the "/users" api endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained via the "search"...

About the security content of macOS Big Sur 11.4

About the security content of macOS Big Sur 11.4 This document describes the security content of macOS Big Sur 11.4. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

About the security content of Safari 14.1.1

About the security content of Safari 14.1.1 This document describes the security content of Safari 14.1.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

About the security content of iOS 14.6 and iPadOS 14.6

About the security content of iOS 14.6 and iPadOS 14.6 This document describes the security content of iOS 14.6 and iPadOS 14.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

UPchieve: Cross-origin resource sharing misconfig | steal user information

Summary An HTML5 cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features ...