CVE-2021-1415

Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code with elevated privileges equivalent to the web service process on an affected device. These...

ALPINE-CVE-2021-22876

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header...

CVE-2021-27646

Use After Free vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests...

CVE-2021-27646

Use After Free vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests...

CVE-2021-26569

Race Condition within a Thread vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests...

CVE-2021-26569

Race Condition within a Thread vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests...

Cross site scripting

Out-of-bounds Read vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests...

Race condition

Race Condition within a Thread vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests...

Design/Logic Flaw

Use After Free vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests...

CVE-2021-27646

CVE-2021-27646 affects Synology DiskStation Manager (DSM) via the iscsi_snapshot_comm_core component. The vulnerability is a Use After Free that enables remote attackers to execute arbitrary code through crafted web requests on DSM versions prior to 6.2.3-25426-3. The issue is rated high/critical...

CVE-2021-27646

Use After Free vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests...

CVE-2021-26569

Race Condition within a Thread vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests...

CVE-2021-27647

Out-of-bounds Read vulnerability in iscsisnapshotcommcore in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests...

Synology DiskStation Manager 资源管理错误漏洞

DiskStation Manager DSM is an operating system that runs on all Synology NAS and can be operated through an intuitive web interface. A post-release reuse vulnerability exists in iscsisnapshotcommcore in Synology DiskStation Manager versions prior to 6.2.3-25426-3. A remote attacker can exploit th...

CVE-2020-19417

Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users such as the default account 'maint' to perform administrative tasks by sending specially crafted HTTP requests to the application...

PT-2021-2270 · Cisco · Cisco Asyncos

Name of the Vulnerable Software and Affected Versions: Cisco AsyncOS Software for Cisco Content Security Management Appliance SMA affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote attacker to access sensitive...

The vulnerability of the Node.js software platform allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Node.js software platform is related to the inconsistent interpretation of HTTP requests. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

CVE-2021-3148

An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.genthin command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py...

CVE-2021-3148

An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.genthin command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py...

CVE-2021-3148

An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.genthin command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py...