Design/Logic Flaw

Successful exploitation of this vulnerability on Claroty Secure Remote Access SRA Site versions 3.0 through 3.2 allows an attacker with local command line interface access to gain the secret key, subsequently allowing them to generate valid session tokens for the web user interface UI. With acces...

D-Link DIR816 安全漏洞

The D-Link DIR816 is a wireless router from Taiwan, China-based AUO D-Link. A security vulnerability exists in the getcfg.php component in the D-Link DIR816 LFW206b01, which can be exploited by an attacker to gain access to the device via a crafted payload...

Cisco Common Services Platform Collector 跨站脚本漏洞

Cisco Common Services Platform Collector CSPC is a common services platform data collector from Cisco USA. The product analyzes network performance and identifies risks and vulnerabilities by polling basic inventory and configuration data from Cisco devices.Cisco Common Services Platform Collecto...

GHSA-J3X5-CWFJ-PFCW Moodle does not force password changes for autosubscribed users

admin/uploaduserform.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user...

GHSA-62WV-866C-RH86 Moodle does not properly restrict comment capabilities

comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote attackers to post a comment by leveraging the guest role and operating on a front-page activity...

Design/Logic Flaw

An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of system integrity...

CVE-2021-46744

An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time...

CVE-2021-44056

An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Video Station: Video Station...

CVE-2021-3898

Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker...

Authentication Bypass

chromium is vulnerable to authentication bypass. The vulnerability exists due to an inappropriate implementation in full screen which allows an attacker to gain access to the application...

Jenkins Google Compute Engine Plugin has an unspecified vulnerability

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.A security vulnerability exists in the Jenkins Google Compute Engine Plugin, which stems from storing unencrypted private...

Information disclosure

Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console CMC - version 430, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure...

Dell Technologies Dell PowerScale OneFS 安全漏洞

Dell PowerScale OneFS provides the PowerScale OneFS operating system for horizontally scaling NAS. Dell PowerScale OneFS has a security vulnerability that could be exploited by an attacker to obtain passwords and use this information to launch further attacks on the affected system...

Sensitive Auth & Cookie data stored in Jupyter server logs

Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Upgrade ...

多款Qualcomm产品访问控制错误漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc., and from time to time are manufactured on the surface of semiconductor wafers. An Access Control Error vulnerability exists in a number of...

Pulse Connect Secure Authentication Bypass (CVE-2021-22893)

An authentication bypass vulnerability exists in Pulse Connect Secure. Successful exploitation of this vulnerability could allow a remote attacker to gain unauthorized access to the affected system...

Jenkins instant-messaging Plugin信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. The vulnerability stems from unencrypted group chat passwords stored in the...

Google Android 安全漏洞

Google Android is a Linux-based open-source operating system from the U.S. Google Android has an information leakage vulnerability that stems from a confusion of agents in Gallery that could bypass permissions and could be used by attackers to obtain sensitive information...

CVE-2022-0858 Cross-site scripting vulnerability in ePO

A cross-site scripting XSS vulnerability in McAfee Enterprise ePolicy Orchestrator ePO prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited abilit...

Incapptic Connect has an unspecified vulnerability

Incapptic Connect is an application plug-in. A security vulnerability exists in Incapptic Connect, which can be exploited by an attacker with elevated access to remotely execute code on the Incapptic Connect server using unspecified attack vectors...