VMware vCenter Server 路径遍历漏洞

Vmware VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructure. vCenter Server is vulnerable to a...

PT-2021-5992

Name of the Vulnerable Software and Affected Versions TP-Link AX10v1 versions prior to v1 211117 Description The issue is related to a deficiency in handling HTTP requests, which can be exploited by a remote unauthenticated attacker to conduct an HTTP request smuggling attack. This can lead to a...

The vulnerability of the SonicOS operating system, related to insufficient protection of operational data, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the SonicOS operating system is related to insufficient protection of operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information through a specially created HTTP request...

CVE-2021-39391

Cross Site Scripting XSS vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page...

SAP CommonCryptoLib代码问题漏洞

SAP CommonCryptoLib is a cryptographic library from SAP, a German company. A security vulnerability exists in SAP CommonCryptoLib version 8.5.38 and below, which stems from a null pointer reference vulnerability in the software. An unauthenticated attacker could use this vulnerability to send...

The vulnerability of the server-based corporate software for project monitoring and management, RoboHelp Server, arises due to an incorrect path limitation to the restricted access catalog. This allows attackers to read arbitrary files.

The vulnerability of server-based corporate software for project monitoring and management with RoboHelp Server exists due to an incorrect limitation on the path to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to read arbitrary files using a specially...

CVE-2021-40284

D-Link DSL-3782 EU v1.01:EU v1.03 is affected by a buffer overflow which can cause a denial of service. This vulnerability exists in the web interface "/cgi-bin/NewGUI/Igmp.asp". Authenticated remote attackers can trigger this vulnerability by sending a long string in parameter 'igmpsnoopEnable'...

istio/istio: HTTP request can bypass authorization mechanisms due to case insensitive host comparison

An authorization bypass vulnerability was found in istio/istio. The case insensitive host comparison incorrectly works when evaluating rules specified with host or notHost. This flaw allows an attacker to bypass an Istio authorization policy that uses hosts in the rules, potentially gaining acces...

D-Link DIR-816 A2 安全漏洞

The D-Link DIR-816 A2 is a wireless router from Taiwan, China-based AUO D-Link. A security vulnerability exists in the D-Link DIR-816A2, which stems from an issue discovered via the HTTP request parameter in the handler function of the goform form2userconfig.cgi route, where a username string can...

CVE-2021-31820

In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI...

CVE-2021-31820

In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI...

CVE-2021-31820

In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI...

CVE-2021-31820: Cleartext Storage of Sensitive Information

In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI...

PT-2021-19528

Name of the Vulnerable Software and Affected Versions Octopus Server versions 2018.8.3 and later Description The issue concerns the Octopus Server Web Request Proxy, where if configured with authentication, the password is displayed in plaintext in the UI. Recommendations For Octopus Server...

CVE-2021-22933

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request...

Buffer overflow

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request...

CVE-2021-22933

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request...

Cross site request forgery (csrf)

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request...

CVE-2021-22934

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request...

CVE-2021-22933

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request...