Rails 跨站脚本漏洞

Rails is a set of open source web application frameworks based on the Ruby language from the Rails team. A cross-site scripting vulnerability exists in the autolink function in versions prior to Rails 3.0.6. No more information on this vulnerability is available at this time, so stay tuned to CNN...

Oracle Virtualization和Oracle VM VirtualBox 安全漏洞

Oracle VM VirtualBox is a virtual machine management software from Oracle. A denial of service vulnerability exists in the Core component of Oracle VM VirtualBox versions prior to 6.1.28, which can be exploited by an attacker to cause Oracle VM VirtualBox to hang or crash frequently and repeatedl...

Combodo iTop 代码问题漏洞

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management. A code issue exists in Combodo iTop versions prior to 2.7.5...

PT-2021-16284 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.26 and prior Description: The issue allows a high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks can result in the unauthorized ability to cause a hang o...

WordPress 插件 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Html5 Audio Player plugin in versions...

Pacemaker 授权问题漏洞

Pacemaker is a scalable, high-availability cluster resource manager. An authorization issue vulnerability exists in Pacemaker that stoneth-ng of the product passes passwords as command line arguments. This vulnerability can be exploited to obtain the HA stack password. The following products and...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.

...

Nagios 路径遍历漏洞

Nagios XI is an IT infrastructure monitoring solution from Nagios, Inc. The solution supports monitoring and alerting of applications, services, operating systems, etc. Nagvis versions prior to 2.0.9 have a security vulnerability that could allow an attacker to arbitrarily delete files on the loc...

CVE-2021-22035

VMware vRealize Log Insight 8.x prior to 8.6 contains a CSVComma Separated Value injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log...

Deno 代码注入漏洞

Deno is open source a simple , modern and secure JavaScript and TypeScript runtime environment . It uses V8 and is built with Rust. A code injection vulnerability exists in Deno versions prior to 0.107.0, which stems from allowing code injection via untrusted YAML files in certain configurations...

Apache OpenOffice 数据伪造问题漏洞

Apache OpenOffice is an open source office software suite from the Apache Apache Foundation. The suite contains text documents, spreadsheets, presentations, drawings, databases, etc. Apache OpenOffice is vulnerable to a data forgery issue in versions prior to 4.1.10, which stems from a networked...

CVE-2021-38432

FATEK Automation Communication Server Versions 1.13 and prior lacks proper validation of user-supplied data, which could result in a stack-based buffer overflow condition and allow an attacker to remotely execute code...

ALPINE-CVE-2021-22930

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...

Zammad 命令注入漏洞

Zammad is a web-based open source help desk/customer support system. a command injection vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit the vulnerability to inject commands via custom packages...

Zoho ManageEngine ADManager Plus 代码问题漏洞

ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and helpdesk technicians with day-to-day administrative tasks, such as batch management of user...

ZOHO ManageEngine ADManager Plus 代码问题漏洞

Zoho ManageEngine ADManager Plus is an easy-to-use Windows Active Directory management and reporting solution. A XXE vulnerability exists in Zoho ManageEngine ADManager Plus versions prior to 7110. No detailed vulnerability details are provided at this time...

Zammad 安全漏洞

Zammad is a Web-based open source help desk/customer support system. remote code execution vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit the vulnerability by sending a specially crafted request to Zammad to execute code on the server...

Cobbler 安全漏洞

Cobbler is a Linux installation server that allows for quick setup of network installation environments.Cobbler is vulnerable to authorization issues in versions prior to 3.3.0.The vulnerability stems from a lack of authentication measures or insufficient authentication strength in the network...

Acinq Eclair 安全漏洞

Acinq Eclair is a Scala implementation of Lightning Networks. A security vulnerability exists in ACINQ Eclair versions prior to 0.6.3. There is no information about this vulnerability at this time, so please stay tuned to CNNVD or vendor announcements...