2299 matches found
Johnson Controls Facility Explorer 安全漏洞
Johnson Controls Facility Explorer is a monitoring controller from Johnson Controls that provides scalable system-wide monitoring and control. A security vulnerability exists in Johnson Controls Facility Explorer that stems from improper privilege management and can be exploited by an attacker to...
AZL-7195 CVE-2021-29157 affecting package dovecot for versions less than 2.3.20-1
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver...
CVE-2021-35050
User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versio...
Insecure Access Control
github.com/pterodactyl/wings allows insecure access to endpoints. An attacker is able to access resources on local networks that would otherwise be inaccessible due to lack of hostname verification...
The vulnerability of the software for implementing the hypertext environment MediaWiki allows a perpetrator to compromise the confidentiality of the protected information.
The vulnerability of the software for implementing the hypertext environment MediaWiki arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious individual to compromise the confidentiality of the protected information due to...
XSS vulnerability in bludit-cms
bludit-cms is a flat file content management system. An XSS vulnerability exists in bludit-cms, which can be exploited by an attacker to obtain sensitive information such as user cookies...
The vulnerability of Trend Micro Deep Security Agent lies in its improper handling of links before accessing a file. This allows attackers to delete any files they desire.
The vulnerability of the Trend Micro Deep Security Agent lies in the improper handling of links before accessing a file. Exploiting this vulnerability could allow an attacker to delete any files they desire...
CVE-2021-27487
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sensitive information...
Hardcoded credentials
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded. This could allow an attacker to gain access to sensitive information...
CVE-2021-27487
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sensitive information...
The vulnerability of the online business analytics service IBM Cognos Analytics, related to the leakage of information in error messages, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the online business analytics service IBM Cognos Analytics is related to the leakage of information in error messages. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
CVE-2021-27637
Under certain conditions SAP Enable Now SAP Workforce Performance Builder - Manager, versions - 1.0, 10 allows an attacker to access information which would otherwise be restricted leading to information disclosure...
CVE-2021-33662
Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to access information which would otherwise be restricted...
Citrix Cloud Connector 安全漏洞
Citrix Systems Citrix Cloud Connector is a Citrix component from Citrix Systems, Inc. that serves as a communication channel between Citrix Cloud and your resource locations, enabling cloud management without any complex network or infrastructure configuration. A security vulnerability exists in...
Nuvoton NPCT 安全漏洞
Intel Nuvoton Consumer Infrared CIR Driver is an infrared driver from Intel Corporation USA. A security vulnerability in the Nuvoton NPCT75x TPM 1.2 firmware version 7.4.0.0, which stems from incorrect access control, allows a highly privileged, locally authenticated attacker to gain unauthorized...
Crocus has an unauthorized access vulnerability
Crocus is an energy data analytics platform. An unauthorized access vulnerability exists in Crocus. An attacker can use the vulnerability to bypass permission determination to access functional pages...
Design/Logic Flaw
An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShif...
Authentication Bypass
github.com/kiali/kiali is vulnerable to authentication bypass. When RBAC is disabled, the token validation in the authentication strategy OpenID does not occur and allows an attacker to bypass authentication...
FortiAuthenticator - Hard-coded cryptographic keys used to encrypt sensitive data
Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator may allow an attacker with access to the files or the CLI configuration to decrypt the sensitive data, via knowledge of the hard-coded key...