CVE-2021-42123 Missing Upload Filter in TopEase

Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 in the File Upload Functions allows an authenticated remote attacker with Upload privileges to upload files with any file type, enabling client-side attacks...

CVE-2021-42544

The CVE-2021-42544 issue affects Business-DNA Solutions GmbH TopEase Platform (Version

CVE-2021-42122 Denial of Service via Invalid Object Attribute in TopEase

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 on an object’s attributes with numeric format allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format, which makes the...

CVE-2021-42122

CVE-2021-42122 affects Business‑DNA Solutions GmbH TopEase Platform (≤7.1.27). The root cause is insufficient input validation on an object’s attributes with numeric format. An authenticated remote attacker with Object Modification privileges can insert an unexpected format, causing the affected ...

CVE-2021-42120

CVE-2021-42120 affects Business-DNA Solutions GmbH TopEase Platform (Version

CVE-2021-42120 Missing Character Length (Denial of Service) in TopEase

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 on all object attributes allows an authenticated remote attacker with Object Modification privileges to insert arbitrarily long strings, eventually leading to exhaustion...

CVE-2021-42121 Denial of Service via Invalid Date Format in TopEase

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 on an object’s date attributes allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format into date fields, which leads t...

CVE-2021-42121

CVE-2021-42121 describes an insufficient input validation vulnerability in Business-DNA Solutions GmbH TopEase Platform (

CVE-2021-42119 Stored XSS in Search Function in TopEase

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then...

CVE-2021-42119

CVE-2021-42119 describes a persistent cross-site scripting vulnerability in Business-DNA Solutions GmbH TopEase platform (version ≤ 7.1.27) exposed through the Search Functionality. The issue arises when authenticated users with Object Modification privileges can inject arbitrary HTML/JavaScript ...

CVE-2021-42118 Stored XSS in TopEase

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object...

CVE-2021-42118

The CVE-2021-42118 entry concerns Business-DNA Solutions GmbH TopEase Platform (<= 7.1.27) via the Structure Component. Affected component is the Structure Component which allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML/JavaScript in an obje...

CVE-2021-42117

CVE-2021-42117 affects Business-DNA Solutions GmbH TopEase Platform (Web Applications)

CVE-2021-42116 Unauthorized Menu Item Access in TopEase

Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functionality for higher privileged users, via identifying said components in the...

CVE-2021-42115

The CVE-2021-42115 entry concerns Business-DNA Solutions GmbH TopEase Platform: versions ≤ 7.1.27 are affected by a Missing HTTPOnly flag on the session cookie UID, enabling an unauthenticated attacker to escalate to an authenticated user by stealing/injecting the cookie. The connected sources re...

CVE-2021-42115 Missing HTTPOnly flag on sensitive cookie in TopEase

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie...

vulhub

This repository is an open-source collection of vulnerable web applications and tools for security training and research. It is maintained by phith0n and hosted on GitHub. The repository contains a variety of vulnerable applications, including web servers, databases, and other systems, to help...

[SECURITY] Fedora 35 Update: mingw-gstreamer1-1.19.3-1.fc35

GStreamer is a streaming-media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plug-in-based architecture means that new data types...

Scholarship Results

Its time to sum up the results of the 2021 scholarship! As you know, we extended the scholarship for 1 month until October 30th because there were many applications and few finished papers. By October 30 the situation had not changed, only 1 essay had been added and became 4, the number of...

Ruby 安全漏洞

Ruby is a cross-platform, object-oriented, dynamically typed programming language. versions prior to Ruby 3.0.3 contain a security vulnerability that can be exploited by attackers to spoof the security prefix in cookie names so that vulnerable applications can be spoofed...