ExpertPDF 安全漏洞

ExpertPDF is a .NET library whose core functionality is to allow the conversion of HTML to PDF, either from raw HTML or from a file. A security vulnerability exists in ExpertPDF that stems from an improperly designed or implemented code development process for a web-based system or product...

Cisco TelePresence Video Communication Server RCE (cisco-sa-ewrce-QPynNCjh)

According to its self-reported version, Cisco TelePresence Video Communication Server is affected by a remote code execution vulnerability in its web-based management interface due to incorrect handling of certain crafted software images that are uploaded to an affected device. An unauthenticated...

ECOA Building Automation System Hidden Backdoor Accounts and backdoor() Function

Summary 1 The Risk-Terminator Web Graphic control BEMS Building Energy Management System are designed to provide you with the latest in the Human Machine Interface HMI technology, for completely monitoring and controlling management. It may be used singly for small and medium sized facilities,...

ECOA Building Automation System Cookie Poisoning Authentication Bypass

Summary 1 The Risk-Terminator Web Graphic control BEMS Building Energy Management System are designed to provide you with the latest in the Human Machine Interface HMI technology, for completely monitoring and controlling management. It may be used singly for small and medium sized facilities,...

Apache Zeppelin Authentication Bypass Vulnerability

Apache Zeppelin is a Web-based open source notebook application from the Apache Foundation that supports interactive data analysis and collaborative documentation. The program supports interactive data analysis and collaborative documentation. Apache Zeppelin 0.9.0 and earlier versions contain a...

Apache Zeppelin Cross-Site Scripting Vulnerability

Apache Zeppelin is a web-based open source notebook application from the Apache Foundation that supports interactive data analysis and collaborative documentation. An xss vulnerability exists. An attacker could exploit this vulnerability to inject malicious scripts...

Cisco Prime Collaboration Provisioning XSS (cisco-sa-prime-collab-xss-fQMDE5GO)

According to its self-reported version, Cisco Prime Collaboration Provisioning is affected by a cross-site scripting XSS vulnerability in its web-based management interface due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the...

CVE-2021-34759 Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the...

CVE-2021-34759

CVE-2021-34759 affects Cisco Identity Services Engine (ISE). The flaw is in the web-based management interface’s input validation, enabling an authenticated attacker with administrative credentials to perform a cross-site scripting (XSS) attack against users of the ISE interface. Exploitation cou...

CVE-2021-34732 Cisco Prime Collaboration Provisioning Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input...

CVE-2021-34732

Cisco Prime Collaboration Provisioning’s web-based management interface is vulnerable to cross-site scripting (XSS) due to insufficient validation of user-supplied input. An unauthenticated, remote attacker can coax a user to click a crafted link, allowing arbitrary script execution within the us...

CVE-2021-34732 Cisco Prime Collaboration Provisioning Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input...

Cisco Prime Collaboration Provisioning Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input...

CVE-2021-39180

OpenOLAT is a web-based learning management system LMS. A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user e.g. the tomcat user. Depending...

CVE-2021-39180

OpenOLAT is a web-based learning management system LMS. A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user e.g. the tomcat user. Depending...

CVE-2021-39180

OpenOLAT is affected by a path traversal vulnerability (CVE-2021-39180) in versions before 15.3.18, 15.5.3, and 16.0.0. An attacker with an OpenOLAT user account can upload a specially crafted ZIP and trigger unzip, enabling overwriting files writable by the application server user (e.g., Tomcat)...

CVE-2021-34578

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

CVE-2021-34578 WAGO: Authentication Vulnerability in Web-Based Management

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

Indexhibit improper access control vulnerability

Indexhibit is a web-based content management system. An improper access control vulnerability exists in the /config/config.php component of Indexhibit version 2.1.5. An attacker could exploit this vulnerability to view arbitrary files...