3405 matches found
A flaw was found in Fedora versions of krb5 from 1.16.1 to including 1.17.x in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user could use this flaw to crash the KDC.
...
CVE-2021-33179
The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who accesses a specially crafted malicious URL, would unknowingly execute the attached payload...
mysql: InnoDB unspecified vulnerability (CPU Jul 2021)
Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server...
mysql: Server: Group Replication Plugin unspecified vulnerability (CPU Apr 2021)
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...
mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2021)
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...
PT-2021-7948
Name of the Vulnerable Software and Affected Versions System.DirectoryServices.Protocols version 5.0.0 Description A information disclosure issue exists where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux. This could allow a remote attacker to...
CVE-2021-29837
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204913...
Vulnerabilities fixed in Squid
Two vulnerabilities have been fixed in Squid. The vulnerabilities potentially allow a remote malicious party to cause a denial-of-service DoS or gain access to sensitive data. The vulnerability with reference CVE-2021-28116 is located in the way Squid handles WCCPv2 traffic. The developers of Squ...
CVE-2021-38925
IBM Sterling B2B Integrator Standard Edition 5.2.0. 0 through 6.1.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 210171...
PT-2021-23276 · Poly · Poly Vvx 400/410
Name of the Vulnerable Software and Affected Versions: Poly VVX 400/410 versions 5.3.1 and earlier Description: The issue allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password reset process. Recommendations: For Poly VVX 400/410 versions...
F-Secure Internet Gatekeeper 输入验证错误漏洞
F-Secure Internet Gatekeeper is a gateway product that acts as a virus scanning agent for HTTP, SMTP, POP, and FTP protocols. a denial of service vulnerability exists in the web user interface of F-Secure Internet Gatekeeper version 5 Series. An attacker could exploit the vulnerability by sending...
F-Secure Internet Gatekeeper代码注入漏洞
F-Secure Internet Gatekeeper is a gateway product that acts as a virus scanning agent for HTTP, SMTP, POP, and FTP protocols.An arbitrary code execution vulnerability exists in the Web user interface of F-Secure Internet Gatekeeper version 5 Series. The vulnerability can be exploited by an attack...
CVE-2021-34348
A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later...
CVE-2021-34349
A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later...
CVE-2020-19951
A cross-site request forgery CSRF in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application...
CVE-2021-36872 WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability
Authenticated Persistent Cross-Site Scripting XSS vulnerability in WordPress Popular Posts plugin versions = 5.3.3. Vulnerable at &widget-wpp2posttype...
YzmCMS 跨站脚本漏洞
YzmCMS is a lightweight open source content management system based on PHP Mysql architecture developed solely by Yuan Zhimeng. cross-site scripting vulnerability exists in the /banner/add.html component of YzmCMS version 5.3. An attacker can exploit this vulnerability to execute arbitrary Web...
mysql: InnoDB unspecified vulnerability (CPU Jan 2021)
Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.6.50 and prior, 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromis...
WordPress 插件 跨站脚本漏洞
WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin Shortcodes Ultimate prior to version 5.10.2, which stems from the plugin allowing users with the Contributor role to execute stored XSS via the Shortcodes...