4889 matches found
CVE-2021-24924
The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24718
The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-20851
Cross-site request forgery CSRF vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors...
CVE-2021-43296
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor...
CVE-2021-43295
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module...
CVE-2021-43319
Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality...
CVE-2021-42099
Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution...
CVE-2021-43202
In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases...
PT-2021-22880 · Apache · Apache Jspwiki
Name of the Vulnerable Software and Affected Versions: Apache JSPWiki versions prior to 2.11.0 Description: A carefully crafted plugin link invocation could trigger an issue on Apache JSPWiki, related to the Denounce plugin, allowing the attacker to execute javascript in the victim's browser and...
CVE-2021-24875
The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-44147
An XML External Entity issue in Claris FileMaker Pro and Server including WebDirect before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks...
Commvault CommCell 代码注入漏洞
Commvault CommCell enables fast, large-scale backup and recovery of virtual machines, structured and unstructured data.A remote code execution vulnerability exists in versions of Commvault CommCell prior to 11.25, which could be exploited by an attacker to execute code in the context of NETWORK...
Commvault CommCell 授权问题漏洞
Commvault CommCell enables fast, large-scale backup and recovery of virtual machines, structured and unstructured data.An authentication bypass vulnerability exists in the CVSearchService service in versions of Commvault CommCell prior to 11.25, which could be exploited by an attacker to bypass...
CVE-2021-23433
The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...
CVE-2021-39234
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL...
PT-2021-5279 · Pulse · Pulse Connect Secure
Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R12.1 Description: A vulnerability in Pulse Connect Secure could allow an unauthenticated administrator to cause a denial of service when a malformed request is sent to the device. This issue is relat...
CVE-2021-0198
Improper access control in the firmware for the IntelR Ethernet Network Controller E810 before version 1.5.5.6 may allow a privileged user to potentially enable a denial of service via local access...
PT-2021-23823 · Meddata · Meddata Hbys
Name of the Vulnerable Software and Affected Versions: MedData HBYS versions prior to 1.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...
Minio 访问控制错误漏洞
Minio MinIO is an open source object storage server from the US-based MinIO Minio. The product supports building infrastructures for machine learning, analytics, and application data workloads. An access control error vulnerability exists in Minio 0.12.2 and prior versions, which stems from an...