Auerswald COMpact 8.0B Arbitrary File Disclosure

Advisory: Auerswald COMpact Arbitrary File Disclosure RedTeam Pentesting discovered a vulnerability in the web-based management interface of the Auerswald COMpact 5500R PBX which allows users with the "sub-admin" privilege to access any files on the PBX's file system. Details ======= Product:...

Auerswald COMfortel 2.8F - Authentication Bypass

Exploit Title: Auerswald COMfortel 2.8F - Authentication Bypass Date: 06/12/2021 Exploit Author: RedTeam Pentesting GmbH Version: 1400/2600/3600 Advisory: Auerswald COMfortel 1400/2600/3600 IP Authentication Bypass RedTeam Pentesting discovered a vulnerability in the web-based configuration...

Zulip code issue vulnerability

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, Zulip suffers from a code issue vulnerability that stems from improper design or implementation during the code...

Crafter CMS Code Execution Vulnerability

Crafter CMS is an open source content management system CMS for digital experience applications.A code execution vulnerability exists in Crafter CMS, which stems from a web-based system or product that does not properly authenticate incoming data. An authenticated attacker could modify the main...

JetBrains YouTrack Injection Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. The software has features such as bug tracking, creating workflows, and monitoring project progress.JetBrains YouTrack is vulnerable to an injection vulnerability that stems from...

ZOHO ManageEngine SupportCenter Plus server-side request forgery vulnerability

ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. Used to allow organizations to effectively manage customer requests, their account and contact information, and service contracts, and in the process provide a superior customer experience, ZOHO...

ZOHO ManageEngine SupportCenter Plus Cross-Site Scripting Vulnerability (CNVD-2021-94825)

ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. A cross-site scripting vulnerability exists in ZOHO ManageEngine SupportCenter Plus, which stems from the product's failure to validate user identities and could be exploited by attackers to obtain a...

How to optimize the Web based Teams

How to optimize the Web based Teams?...

kimai2 cross-site scripting vulnerability (CNVD-2021-94816)

kimai2 is an open source, web-based multi-user time tracking application. kimai2 suffers from a cross-site scripting vulnerability that can be exploited by attackers to perform cross-site scripting attacks...

kimai2 cross-site scripting vulnerability

kimai2 is an open source, web-based multi-user time tracking application. kimai2 suffers from a cross-site scripting vulnerability, for which no details of the vulnerability are currently available...

ZOHO ManageEngine SupportCenter Plus Cross-Site Scripting Vulnerability (CNVD-2021-94824)

ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. used to allow organizations to effectively manage customer requests, their account and contact information, service contracts, and provide a superior customer experience in the process.A cross-site...

kimai 跨站脚本漏洞

kimai2 is an open source, web-based multi-user time tracking application. kimai2 suffers from a cross-site scripting vulnerability, for which no details of the vulnerability are currently available...

Zoho ManageEngine SupportCenter Plus 代码问题漏洞

ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. Used to allow organizations to effectively manage customer requests, their account and contact information, and service contracts, and in the process provide a superior customer experience, ZOHO...

Aanderaa GeoView SQL注入漏洞

Aanderaa GeoView is a web-based solution for displaying environmental data. Aanderaa GeoView suffers from a SQL injection vulnerability that can be exploited by an attacker to manipulate the database server...

USN-5151-2: Mailman vulnerabilities

USN-5151-1 fixed several vulnerabilities in Mailman. This update provides the corresponding update for Ubuntu 20.04 ESM. Original advisory details: It was discovered that Mailman incorrectly handled certain URL. An attacker could possibly use this issue to execute arbitrary code. CVE-2021-43331 I...

Open-xchange OX App Suite Information Disclosure Vulnerability (CNVD-2021-90765)

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company that allows users to more intuitively manage email, tasks, files, etc. An information disclosure vulnerability exists in Open-xchange OX App Suite. An information disclosure...

Open-xchange OX App Suite Information Disclosure Vulnerability (CNVD-2021-90763)

Open-xchange OX App Suite is a Web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. An information disclosure vulnerability exists in Open-xchange OX App Suite, which could be...

PortlandLabs Concrete CMS has an unspecified vulnerability (CNVD-2021-94038)

PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. PortlandLabs Concrete CMS has a security vulnerability that stems from improper design or implementation during the code development of a web-based system or product. No detailed vulnerabili...

Open-xchange OX App Suite 跨站脚本漏洞

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...

CKEditor cross-site scripting vulnerability (CNVD-2021-92475)

CKEditor is an open source, web-based text editor. CKEditor suffers from a cross-site scripting vulnerability, which stems from the product's failure to effectively filter special characters in input data. An attacker can execute client-side code through this vulnerability...