4743 matches found
forkcms 跨站脚本漏洞
forkcms is a software application. A CMS. A security vulnerability exists in forkcms prior to 5.11.1. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...
Nozomi Networks Guardian 输入验证错误漏洞
Nozomi Networks Guardian is an IoT device and software inspection system from Nozomi Networks, Switzerland. An input validation error vulnerability exists in versions of Nozomi Networks Guardian prior to 22.0.0, which can be exploited by an authenticated attacker with the role of Administrator or...
CVE-2022-25269
Passwork On-Premise Edition before 4.6.13 has multiple XSS issues...
CVE-2021-4180
An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the wwwauthenticateuri parameter which is visible to all end users in configuration files. This would give sensitive...
CVE-2022-1030
Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute...
CVE-2022-27228
In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...
Bitrix Site Manager 输入验证错误漏洞
Bitrix Site Manager is a web site management system from Bitrix USA. A security vulnerability exists in Bitrix Site Manager prior to version 21.0.100. An unauthenticated attacker could remotely execute arbitrary code...
ungit 参数注入漏洞
ungit is a simple way to use git by Fredrik Noren, a Swedish personal developer. A parameter injection vulnerability exists in ungit before 1.5.20, which can be exploited by an attacker to conduct a Remote Code Execution RCE attack...
PT-2022-12474 · Pascom +2 · Pascom Cloud Phone System +2
Name of the Vulnerable Software and Affected Versions: Pascom Cloud Phone System versions prior to 7.20.x Description: A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints. Recommendations: For versions prior...
PT-2022-16769
Name of the Vulnerable Software and Affected Versions Open Web Analytics versions prior to 1.7.4 Description The issue allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files...
CVE-2021-43956
The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability...
CVE-2021-29134
The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...
showdoc 跨站脚本漏洞
showdoc is open source and a great tool for IT teams to share documents online. showdoc versions prior to 2.10.4 have a security vulnerability that stems from the application allowing the upload of .ofd files, which leads to a cross-site scripting vulnerability. No detailed vulnerability details...
showdoc 跨站脚本漏洞
showdoc is an open source tool ideal for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability that stems from the lack of effective detection of .xsl file extensions in the application's file upload feature. An attacker could exploit this...
CVE-2021-45886
An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...
Liblouis 安全漏洞
Liblouis is an open-source Braille translator written in C. It is a very easy to use and easy to use. A security vulnerability exists in Liblouis before 3.21.0. The vulnerability stems from a buffer overflow in compileTranslationTable.c in compilePassOpcode...
CVE-2022-0926
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0870
Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...