PT-2021-21895 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 6.0 and earlier Description: The issue arises from insufficient validation of parameters during post creation, allowing authenticated attackers to cause a client-side crash of the web application via a maliciously crafted...

CVE-2021-45018

Cross Site Scripting XSS vulnerability exists in Catfish =6.3.0 via a Google search in url:/catfishcms/index.php/admin/Index/addmenu.htmland then the .html file on the website that uses this editor the file suffix is allowed...

CVE-2021-43765

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

Fortinet FortiAuthenticator 授权问题漏洞

Fortinet FortiAuthenticator, a centralized user identity management solution from Fortinet, Inc. is vulnerable to an authentication bypass vulnerability in version 6.4.0 due to improper design or implementation of the authentication module code. issue. An attacker could exploit this vulnerability...

CVE-2021-36188

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted GET parameters in requests to login and error handlers...

CVE-2021-43063

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage...

PT-2021-21172 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: Fortinet FortiWeb versions 6.4.1 and below Fortinet FortiWeb versions 6.3.15 and below Description: The issue involves an unintended proxy or intermediary, referred to as a 'confused deputy', which allows an unauthenticated attacker to access...

CVE-2021-42132

A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...

Octopus Server 配置错误漏洞

Octopus Server is an automated deployment platform. A misconfiguration vulnerability exists in Octopus Tentacle that stems from a misconfiguration of the product's systemd file on Linux systems. An attacker could gain privileged access by modifying the systemd file. The following products and...

Vulnerabilities fixed in VMware vCenter

VMware has fixed vulnerabilities in vCenter server. A malicious party on the local network, with access to port 443 could exploit the vulnerabilities to gain access to sensitive data. VMware did not release further details. VMWare has released updates to fix the vulnerabilities in vCenter server...

CVE-2021-43046

The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain session tokens for the affected system. A successful attack using this vulnerability...

TIBCO Partnerexpress 加密问题漏洞

TIBCO Partnerexpress is a Php-based platform that generates barcodes by product name from TIBCO USA. A cryptographic issue exists in Tibco PartnerExpress where the product does not encrypt session tokens during interactions. An attacker could obtain the token to simulate an interaction. The...

PT-2021-23879 · Atmail · Atmail

Name of the Vulnerable Software and Affected Versions: Atmail version 6.5.0 Description: The issue affects the WebAdmin Control Panel, allowing XSS via the format parameter to the default URI. This problem only affects products that are no longer supported by the maintainer. Recommendations: For...

CVE-2020-23896

A User Mode Write AV in Editor+0x576b of WildBit Viewer v6.6 allows attackers to cause a denial of service DoS via a crafted tiff file...

WildBit Viewer 缓冲区错误漏洞

WildBit Viewer is a compact image viewer with slide show and editor. A buffer overflow vulnerability exists in Editor+0x5cd7 in WildBit Viewer version 6.6, which can be exploited by an attacker to cause a denial of service via a specially crafted tiff file...

CVE-2021-29243

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS...

CVE-2021-32482

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter...

CVE-2021-36181

A concurrent execution using shared resource with improper Synchronization vulnerability 'Race Condition' in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific...

Fortinet FortiPortal 跨站脚本漏洞

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. A security vulnerability in the web interface of Fortinet FortiPortal prior to 6.0.6 with...

ZOOM Zoom Call Recording 代码问题漏洞

ZOOM Zoom Call Recording is a scalable session recording management solution from Zoom ZOOM USA. The product supports features such as recording, managing and finding session records. A code issue exists in Zoom Call Recording version 6.3.1, which stems from the software's built-in RMI service th...