12554 matches found
CVE-2021-26702: Improper Neutralization of Input During Web Page Generation
EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/datasetdictionary URI...
CVE-2021-26476: Improper Neutralization of Special Elements used in an OS Command
EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI...
EPrints 安全漏洞
EPrints is a free open source software package for building open access repositories compliant with the OAI-PMH protocol. EPrints 3.4.2 suffers from a command injection vulnerability. A remote attacker can exploit this vulnerability by entering specially crafted data into cgi/cal?year= URI to...
PT-2021-17099
Name of the Vulnerable Software and Affected Versions EPrints version 3.4.2 Description The issue allows for a reflected XSS opportunity. This is due to the dataset parameter in the "cgi/dataset dictionary" URI being vulnerable. Recommendations For EPrints version 3.4.2, update to a newer version...
PT-2021-17101
Name of the Vulnerable Software and Affected Versions EPrints version 3.4.2 Description The issue allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a "cgi/toolbox/toolbox" URI. This can lead to unauthorized access and control of the system...
PT-2021-20137
Name of the Vulnerable Software and Affected Versions EPrints version 3.4.2 Description The issue allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a "cgi/latex2png?latex=" URI. Recommendations For EPrints version 3.4.2, as a temporary...
PT-2021-17100
Name of the Vulnerable Software and Affected Versions EPrints version 3.4.2 Description The issue allows remote attackers to read arbitrary files and possibly execute commands by providing crafted JSON or XML input to the "cgi/ajax/phrase" API endpoint. Recommendations For EPrints version 3.4.2,...
PT-2021-17022
Name of the Vulnerable Software and Affected Versions EPrints version 3.4.2 Description The issue allows remote attackers to execute OS commands via crafted LaTeX input to a "cgi/cal?year=" URI. Recommendations For EPrints version 3.4.2, consider restricting access to the cgi/cal endpoint until a...
CVE-2021-26703: Improper Restriction of XML External Entity Reference
EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted JSON/XML input to a cgi/ajax/phrase URI...
CVE-2021-26704: Improper Neutralization of Special Elements used in an OS Command
EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI...
CVE-2021-3342: Improper Neutralization of Special Elements used in an OS Command
EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a cgi/latex2png?latex= URI...
EPrints 跨站脚本漏洞
EPrints is a free open source software package for building open access repositories compliant with the OAI-PMH protocol. A reflected cross-site scripting vulnerability exists in the year parameter of the cgi/cal URI in EPrints 3.4.2. No detailed vulnerability details are provided at this time...
PT-2021-17021
Name of the Vulnerable Software and Affected Versions EPrints version 3.4.2 Description The issue exposes a reflected XSS opportunity via a cgi/cal URI. Recommendations For EPrints version 3.4.2, update to a newer version that contains a fix for this issue...
CVE-2021-26475: Improper Neutralization of Input During Web Page Generation
EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI...
D-Link DAP-2020 errorpage External Control of File Name Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the...
D-Link DAP-2020 WEB_CmdFileList Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. The issue results from the...
D-Link DAP-2020 webproc getpage Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the getpage...
Updated privoxy package fixes security vulnerabilities
Fixed a memory leak when decompression fails "unexpectedly". CVE-2021-20216 Prevent an assertion from getting triggered by a crafted CGI request. CVE-2021-20217...
