CVE-2021-34767

A vulnerability in IPv6 traffic processing of Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, adjacent attacker to cause a Layer 2 L2 loop in a configured VLAN, resulting in a denial of service DoS condition for that...

Cloudron 跨站脚本漏洞

Cloudron is a platform from Cloudron, Inc. for installing, managing, and securing web applications on servers. A security vulnerability exists in Cloudron 6.2 that stems from insufficient validation of the returnTo parameter input on the login page...

CVE-2021-39537

An issue was discovered in ncurses through v6.2-1. nccaptoinfo in captoinfo.c has a heap-based buffer overflow...

PT-2021-23282 · Realvnc · Realvnc Viewer

Name of the Vulnerable Software and Affected Versions: RealVNC Viewer version 6.21.406 Description: The issue allows remote VNC servers to cause a denial of service, resulting in the application crashing via crafted RFB protocol data. It is noted that this issue requires social engineering to tri...

CVE-2021-37913

The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in...

emlog 跨站请求伪造漏洞

Emlog is Emlog personal developer of a PHP and MySQL based CMS site building system . There is a security vulnerability in emlog v6.0 that can be exploited by attackers to add articles at will...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager is an enterprise content management solution that helps you simplify the management and delivery of content and assets. Adobe Experience Manager CS, version 6.5.10.0 is vulnerable to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to execu...

CVE-2021-3049

An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of. This issue impacts: All Cortex...

CVE-2021-36095

Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG OTRS Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions...

OpenEMR 日志信息泄露漏洞

OpenEMR is an open source medical management system from the OpenEMR Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing requests. A security vulnerability exists in OpenEMR 6.0.0 that originates from an...

Openkm OpenKM 跨站脚本漏洞

Openkm OpenKM is a document management system from the Spanish company OpenKM Openkm. The system provides features such as version control, document history, and file sharing. A cross-site scripting vulnerability exists in OpenKM Community Edition, which stems from the product's uuid field failin...

CVE-2021-28625

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

PT-2021-22565 · Gnome +2 · Gnome Libgda +2

Name of the Vulnerable Software and Affected Versions: GNOME libgda versions prior to 6.0.1 Description: The issue is related to the failure to enable TLS certificate verification on the SoupSessionSync objects created in gda-web-provider.c, making users susceptible to network man-in-the-middle...

libgd 信任管理问题漏洞

libgd is an open source library for dynamically creating images that supports the creation of charts, graphs, thumbnails, etc. by Thomas Boutell, an individual developer in the United States. A trust management issue vulnerability exists in libgd, which stems from the fact that in GNOME libgda...

CVE-2021-37711

Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin...

CVE-2021-37586

The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user with Administrator rights to replay a previously recorded conversation of another tenant due to insufficient validation...

CVE-2021-37704

PhpFastCache is a high-performance backend cache system packagist package phpfastcache/phpfastcache. In versions before 6.1.5, 7.1.2, and 8.0.7 the phpinfo can be exposed if the /vendor is not protected from public access. This is a rare situation today since the vendor directory is often located...

Cohesity Linux agent 安全漏洞

Cohesity Linux agent is used in different installer packages to provide support for multiple Linux distributions. A security vulnerability exists in Cohesity Linux agent, which stems from the product's lack of an effective privilege management mechanism. The vulnerability can be exploited to gain...

Microchip MiWi 安全漏洞

Microchip MiWi is a proprietary wireless protocol from Microchip that supports point-to-point star network connections. A security vulnerability exists in Microchip MiWi v6.5 that can bypass privilege authentication for illegal operation...

CVE-2021-36168

A Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in Fortinet FortiPortal 6.x before 6.0.5, FortiPortal 5.3.x before 5.3.6 and any FortiPortal before 6.2.5 allows authenticated attacker to disclosure information via crafted GET request with malicious parameter values...