Samsung Bixby Touch安全漏洞

An access control error vulnerability exists in Samsung Bixby Touch, a virtual intelligent assistant for Samsung mobile devices, which stems from a failure to properly restrict access to resources from unauthorized roles in Bixby Touch. An attacker could exploit the vulnerability to allow untrust...

CVE-2021-44610

Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 URLs, 2 langid, 3 tmplid, 4 modrewrite 5 etadoctype. 6 metacharset, 7 defaultgroup, and 8 page group parameters in the settings mode in admin/index.php...

duck 安全漏洞

Debian duck is used to check URLs. A security vulnerability exists in duck that stems from not properly handling the loading of untrusted code from the current directory...

Jenkins 插件权限许可和访问控制问题漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. an access control error vulnerability in Jenkins autonomiq Plugin 1.15 and earlier versions, which stems from not performi...

The vulnerability in the isolated iframe of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, relates to improper handling of user data. This allows an attacker to perform a spoofing attack.

The vulnerability of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, is related to the improper handling of user data. Exploiting this vulnerability allows a malicious actor to perform a spoofing attack when executing a program and processing an external URL request...

ZTE BigVideo Analysis product 输入验证错误漏洞

ZTE Big Video Analysis Product is a big video analysis product from China's ZTE Corporation ZTE. The ZTE BigVideo Analysis product suffers from an input validation error vulnerability that originates from inconsistent forward and reverse validation when configuring a big screen page, which can be...

ZEIT Next.js 输入验证错误漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. ZEIT Next.js suffers from an input validation error vulnerability that stems from the software's lack of effective handling of incorrectly formatted urls. An invalid or incorrectly...

CVE-2021-43358

Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download system files...

CVE-2021-43358

Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download system files...

CVE-2021-22049

The vSphere Web Client FLEX/Flash contains an SSRF Server Side Request Forgery vulnerability in the vSAN Web Client vSAN UI plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an...

curl: Leak of authentication credentials in URL via automatic Referer

It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the Referer HTTP request header while handling HTTP redirects. This could lead to exposure of the credentials to the server to which requests were redirected...

CVE-2021-23028

On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall WAF/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests m...

GHSA-CXFM-5M4G-X7XP A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security...

CVE-2021-3048

Certain invalid URL entries contained in an External Dynamic List EDL cause the Device Server daemon devsrvr to stop responding. This condition causes subsequent commits on the firewall to fail and prevents administrators from performing commits and configuration changes even though the firewall...

SAP Netweaver 输入验证错误漏洞

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform primarily provides a development and runtime environment for SAP applications. An input validation error vulnerability exists in SAP NetWeaver Knowledge Management, which allows...

Obsidian 安全漏洞

Plesk Obsidian is a hosting control panel from the Swiss company Plesk. Obsidian suffers from a security vulnerability that stems from not requiring the user to validate a non-http https url...

OpenStack 输入验证错误漏洞

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration NASA in collaboration with Rackspace in the United States. Openstack Nova suffers from an input validation error vulnerability that allows remote attackers to exploit the vulnerability ...

CVE-2021-29954

Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service. This vulnerability affects Hubs Cloud mozillareality/reticulum/1.0.1/20210428201255...

Feehi CMS 代码问题漏洞

FeehiCMS is a Php-based CMS website builder by Liufee Personal Developer. Feehi CMS 2.1.1 suffers from a code issue vulnerability that stems from the server being able to send requests to any url when the user modifies the HTTP Referer header to it...

GHSA-CF2X-RQC8-GRFQ Regular expression deinal of service in express-validators

All versions of package express-validators are vulnerable to Regular Expression Denial of Service ReDoS when validating specifically-crafted invalid urls...