Amazon Wireless-N WiFi Repeater 跨站脚本漏洞

Amazon Wireless-N WiFi Repeater is a Singapore Amazon open source wireless WIFI. provides an Internet access feature. A security vulnerability exists in Wireless-N WiFi Repeater REV 1.0 28.08.06.1, which can be exploited by an attacker to steal LAN credentials without connecting to the device...

Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests

A flaw was discovered in Undertow where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from...

CVE-2020-35752

Baby Care System 1.0 is affected by a cross-site scripting XSS vulnerability in the Edit Page tab through the Post title parameter...

libzmq 缓冲区错误漏洞

ZeroMQ libzmq 0MQ is a lightweight distributed messaging engine core library. A security vulnerability exists in libzmq, which can be exploited by an attacker to trigger a denial of service and potentially run code via a buffer overflow via libzmq's ZMTP V1 packet...

Denial of Service (DoS)

Overview github.com/pires/go-proxyproto is a Go library implementation of the PROXY protocol, versions 1 and 2. Affected versions of this package are vulnerable to Denial of Service DoS via the parseVersion1 function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It wi...

Stored XSS vulnerability in artifact-repository-parameter

artifact-repository-parameter 1.0.0 and earlier does not escape parameter names and descriptions. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. artifact-repository-parameter 1.0.1 escapes parameter names and descriptions...

CVE-2021-27228

An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...

CVE-2021-27228

An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...

Moe Shinobi through ocean Trust Management Issues Vulnerability

Moe Shinobi through ocean is an application for the Moe community in Canada. It provides i video management functionality. Shinobi through ocean version 1 suffers from a trust management issue vulnerability, which can be exploited by an attacker to achieve full access to the user management API...

PHPGurukul Online Book Store SQL注入漏洞

Online BookStore is an online bookstore program. There is a sql injection vulnerability in Online Book Store v1.0. The vulnerability is caused by the id parameter in detail.php not filtering special characters, and an attacker can execute arbitrary SQL statements through this vulnerability...

CVE-2021-20407

IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system. IBM X-Force ID: 196185...

CVE-2021-3294

CASAP Automated Enrollment System 1.0 is affected by cross-site scripting XSS in users.php. An attacker can steal a cookie to perform user redirection to a malicious website...

Google Discloses Severe Bug in Libgcrypt Encryption Library—Impacting Many Projects

A "severe" vulnerability in GNU Privacy Guard GnuPG's Libgcrypt encryption software could have allowed an attacker to write arbitrary data to the target machine, potentially leading to remote code execution. The flaw, which affects version 1.9.0 of libgcrypt, was discovered on January 28 by Tavis...

Z-BlogPHP 安全漏洞

Z-BlogPHP is an open source PHP-based blogging system for the Z-blog community. A security vulnerability exists in Z-BlogPHP version 1.6.0, which stems from the passwordvisitinputpassword function in zbuser/plugin/passwordvisit/include.php that uses loose comparisons for authentication, which...

Zyxel NBG2105 Authorization Issues Vulnerability

The Zyxel NBG2105 is a router from China's Heqin Technology Zyxel. A security vulnerability exists in the Zyxel NBG2105 V1.00 that originates from setting a login cookie that provides administrator privileges...

Bosch PRAESIDEO and Bosch PRAESENSA Cross-Site Scripting Vulnerabilities

Bosch Praesideo and Bosch Praesensa are both products of Bosch, Germany.Bosch Praesideo is a device for digital broadcasting in public places. The device can provide daily information dissemination, emergency broadcasting, fire alarm and other functions for buildings and public places.Bosch...

PT-2020-17040 · Oaid · Oaid Tengine Lite

Name of the Vulnerable Software and Affected Versions: OAID Tengine lite version v1.0 Description: The serializer module in OAID Tengine lite has a reported Buffer Overflow issue, which can cause a crash. However, there is some uncertainty regarding the existence of proof for this overflow...

CVE-2020-27397

Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to gain remote code execution RCE on the Hosting web server via uploading a maliciously crafted PHP file...

Phpgurukul Online Marriage Registration System SQL注入漏洞

Online Marriage Registration System is a website builder that supports online marriage registration. A SQL injection vulnerability exists in Online Marriage Registration System version 1.0, which stems from a lack of validation of the searchdata parameter of the search.php request against an...

Sourcecodester Alumni Management System SQL Injection Vulnerability

Sourcecodester Alumni Management System is a Php, Mysql based alumni management system from Sourcecodester, Inc. in the United States. Sourcecodester Alumni Management System version 1.0 suffers from a SQL injection vulnerability, SQL injection was originally discovered by Ankita Pal in October...