XWiki Platform 安全漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform, which stems from the fact that in the affected version, any user with SCRIPT privileges can read any file located in an...

PrinterLogic Web Stack 安全漏洞

PrinterLogic Web Stack PrinterLogic Printer Installer is a native Web application from PrinterLogic, Inc. It enables the It department to manage and automate the creation/dissemination of printer Objects and printer drivers across print environments from a single management console. PrinterLogic...

CVE-2021-39070

IBM Security Verify Access 10.0.0.0, 10.0.1.0 and 10.0.2.0 with the advanced access control authentication service enabled could allow an attacker to authenticate as any user on the system. IBM X-Force ID: 215353...

WordPress Use Any Font plugin <= 6.2 - Unauthenticated Arbitrary CSS Appending vulnerability

Unauthenticated Arbitrary CSS Appending vulnerability discovered by Krzysztof Zając in WordPress Use Any Font plugin versions = 6.2. Solution Update the WordPress Use Any Font plugin to the latest available version at least 6.2.1...

Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS Appending

The plugin does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend, it could also lead to Stored XSS issues PoC...

PT-2022-15997

Name of the Vulnerable Software and Affected Versions openstack-barbican affected versions not specified Description An authorization flaw was found in the default policy rules for the secret metadata API, allowing any authenticated user to add, modify, or delete metadata from any secret regardle...

CVE-2021-36294

Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulnerability by forging a cookie to login as any user...

Construction Industry Solutions Conis Construction Cloud 输入验证错误漏洞

Construction Industry Solutions Conis Construction Cloud is an end-to-end cloud and mobile software solution from Construction Industry Solutions, Inc. Construction Industry Solutions Conis Construction Cloud is vulnerable to an input validation error that could be exploited by an attacker to cau...

Palo Alto Networks Cortex XDR 信息泄露漏洞

Palo Alto Networks Cortex XDR is a security operations platform for remote endpoint-based detection from Palo Alto Networks Malaysia. A security vulnerability exists in the Palo Alto Networks Cortex XDR agent that can be exploited by an attacker to read the contents of any file on the system with...

Spinnaker 访问控制错误漏洞

Spinnaker is a continuous delivery platform. Used to release software changes with high speed and confidence. Spinnaker has a security vulnerability that stems from the presence of inappropriate privileges in the software that allow for pipeline creation and execution. This allows an arbitrary us...

CVE-2021-37128

HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file...

Huawei HarmonyOS Path Traversal Vulnerability (CNVD-2021-103541)

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. Huawei HarmonyOS has a security vulnerability. An attacker could exploit the vulnerability to write any content to any file...

CVE-2021-43156

In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admindelete.php allows a remote attacker to delete any book...

CVE-2021-43156

In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admindelete.php allows a remote attacker to delete any book...

Accops HyWorks Windows Client Integer Overflow Vulnerability

Accops HyWorks is a suite of solutions consisting of software and hardware from Accops India. It is used for instant and secure remote access to enterprise applications from anywhere, on any device and from any network. An integer overflow vulnerability exists in the Accops HyWorks Windows Client...

VulnCheck KEV: CVE-2021-4073

The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function socialloginusingemail of the plugin. This...

CVE-2021-43175

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly,...

CVE-2021-37088

There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers can write any content to any file...

PT-2021-23760 · Unknown · Goautodial

Name of the Vulnerable Software and Affected Versions: GOautodial versions prior to commit 3c3a979 Description: The issue concerns incorrect validation of the username and password parameters in the API router, allowing for successful authentication with any specified values. Recommendations: For...

CVE-2021-24647

The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or userna...