CVE-2021-30829

A URI parsing issue was addressed with improved parsing. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local user may be able to execute arbitrary files...

Code injection

A URI parsing issue was addressed with improved parsing. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local user may be able to execute arbitrary files...

CVE-2021-30829

A URI parsing issue was addressed with improved parsing. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local user may be able to execute arbitrary files...

S-CMS XML External Entity Injection Vulnerability

S-CMS is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station of the product. S-CMS 3.0 version of the /api/notify.php exists XML external entity injection vulnerability. An attacker can use this vulnerability to read arbitrary files...

CVE-2020-19954

An XML External Entity XXE vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files...

Xxe

An XML External Entity XXE vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files...

Draytek VigorConnect Local File Inclusion Vulnerability

VigorConnect is the local network management software for DrayTek devices.A local file inclusion vulnerability exists in the file download functionality of the WebServlet endpoint of Draytek VigorConnect version 1.6.0-B3. An attacker could exploit this vulnerability to download arbitrary files fr...

Emlog Authorization Issues Vulnerabilities

Emlog is a PHP and MySQL based CMS builder for Emlog personal developers. A license issue vulnerability exists in Emlog, which stems from the product's lack of an effective restriction added to the admin/plugin.php file deletion feature. An attacker can exploit this vulnerability to delete...

Schneider Electric IGSS Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric IGSS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of TCP traffic by the dc.exe process. The issue results from the...

CVE-2021-20124

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

CVE-2021-20124

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

CVE-2021-20123

Draytek VigorConnect 1.6.0-B3 exposes a local file inclusion flaw in the DownloadFileServlet, allowing an unauthenticated attacker to download arbitrary files from the host with root privileges. Affected component: DownloadFileServlet/file download functionality. Root-cause: LFI in the file downl...

CVE-2021-20123

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

CVE-2021-20123

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

USN-5078-3 squashfs-tools vulnerability

USN-5078-1 fixed a vulnerability in Squashfs-Tools. That update was incomplete and could still result in Squashfs-Tools mishandling certain malformed SQUASHFS files. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Richard Weinberger discovered that...

Siemens SINEC NMS Path Traversal Vulnerability (CNVD-2021-77595)

SINEC NMS is a network management system from Siemens for monitoring and managing industrial networks.A path traversal vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1 when exporting firmware containers. An attacker could exploit this vulnerability to create arbitrary files on...

Siemens SINEC NMS Path Traversal Vulnerability (CNVD-2021-77583)

SINEC NMS is Siemens' network management system for monitoring and managing industrial networks. A path traversal vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1. The vulnerability stems from the fact that the affected system allows arbitrary files to be downloaded under...

CVE-2021-20123

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

Siemens SINEC NMS Arbitrary File Deletion Vulnerability

SINEC NMS, a network management system from Siemens for monitoring and managing industrial networks, is vulnerable to arbitrary file deletion in versions prior to SINEC NMS 1.0 SP2 Update 1. An attacker could use this vulnerability to delete arbitrary files or directories in the user control path...

CVE-2021-20124

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Recent...