Denial of Service in cortezaproject/corteza-server

You can put a very long login email text until you get the last user to put and aries or DoS. Normally emails have 64 to 225 digits. Summary There is no limit to the number of characters in the login email, which allows a DoS attack. The DoS attack affects both server-side and client-side. NOTE:...

CVE-2021-32772

Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed, which allo...

CVE-2021-37216

QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data...

Cross site scripting

QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data...

CVE-2021-32796

xmldom is an open source pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes duri...

多款Geutebrück产品操作系统命令注入漏洞

Geutebrück G-Code EEC-2xxx and so on are products of Geutebrück Germany.Geutebrück G-Code EEC-2xxx is an analog video encoder module.Geutebrück G-Cam EBC-21xx is an EBC-21xx series network camera. The Geutebrück G-Cam EFD-22xx is an EFD-22xx series network camera. An operating system command...

多款Geutebrück产品操作系统命令注入漏洞

Geutebrück G-Code EEC-2xxx and so on are products of Geutebrück Germany.Geutebrück G-Code EEC-2xxx is an analog video encoder module.Geutebrück G-Cam EBC-21xx is an EBC-21xx series network camera. The Geutebrück G-Cam EFD-22xx is an EFD-22xx series network camera. An operating system command...

NCH Axon PBX Cross-Site Scripting Vulnerability (CNVD-2021-55887)

NCH Axon PBX is a set of virtual telephone switch software used in commercial environments. A cross-site scripting vulnerability exists in NCH Axon PBX, which stems from the failure of the product's outbound dialing plan to properly filter incoming data for special characters, which can be...

NCH FlexiServer 路径遍历漏洞

NCH FlexiServer is a functional time and attendance software.NCH FlexiServer has a directory traversal vulnerability, which originates from the product's syslog?file=/... Failure to filter special characters, an attacker can use this vulnerability to obtain sensitive information...

NCH Axon PBX 跨站脚本漏洞

NCH Axon PBX is a set of virtual telephone switch software used in commercial environments. The software is primarily used to manage telephone call centers and implements the functionality of a telephone switch in software.A cross-site scripting vulnerability exists in NCH Axon PBX, which stems...

NCH Axon PBX 跨站脚本漏洞

NCH Axon PBX is a set of virtual telephone switch software used in business environments. The software is primarily used to manage telephone call centers and implements the functionality of a telephone switch in software.A cross-site scripting vulnerability exists in NCH Axon PBX, which stems fro...

NCH IVM Attendant 跨站脚本漏洞

NCH IVM Attendant is an application of nch. A cross-site scripting vulnerability exists in NCH IVM Attendant, which stems from the product's Mailbox name failing to properly filter incoming data for special characters, and could be exploited by attackers to execute client-side code...

Security update for caribou (important)

openSUSE Security Update: Security update for caribou Announcement ID: openSUSE-SU-2021:1071-1 Rating: important References: 1186617 1187112 Cross-References: CVE-2021-3567 CVSS scores: CVE-2021-3567 SUSE: 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 An...

Combodo iTop 命令注入漏洞

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management, and problem management functionality. A command injection vulnerability exists in...

CVE-2021-35968

The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges...

CVE-2021-35967

The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the system directory thru Path Traversal without logging in...

CVE-2021-35968

The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges...

LearningDigital Orca HCM digital learning platform 路径遍历漏洞

The LearningDigital Orca HCM digital learning platform is a digital learning platform from China-based LearningDigital. A path traversal vulnerability exists in the LearningDigital Orca HCM digital learning platform, which stems from the platform's directory listing page parameters not properly...

CVE-2021-35962

Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote attackers can apply Path Traversal means to download credential files from the system without permission...

Information Disclosure

jetty-http is vulnerable to information disclosure. Insecure parsing of encoded characters allow an attacker to bypass security constraints and potentially access private files within the WEB-INF directory...