8471 matches found
CVE-2021-23262
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...
MilleGPG5 5.7.2 Luglio 2021 - Local Privilege Escalation Vulnerability
Exploit Title: MilleGPG5 5.7.2 Luglio 2021 x64 - Local Privilege Escalation Author: Alessandro 'mindsflee' Salzano Vendor Homepage: https://millegpg.it/ Software Homepage: https://millegpg.it/ Software Link: https://www.millegpg.it/download/MilleGPGInstall.exe Version: 5.7.2 Tested on: Microsoft...
IBM MQ Appliance has an unspecified vulnerability (CNVD-2021-92963)
The IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM U.S.A. A security vulnerability exists in the IBM MQ Appliance that stems from the appliance being affected by a denial-of-service attack caused by a concurrency issue. No detail...
CVE-2021-43697
Workerman-ThinkPHP-Redis last update Mar 16, 2018 is affected by a Cross Site Scripting XSS vulnerability. In file Controller.class.php, the exit function will terminate the script and print the message to the user. The message will contain $GETC'VARJSONPHANDLER' then there is a XSS vulnerability...
CVE-2021-43697
Workerman-ThinkPHP-Redis last update Mar 16, 2018 is affected by a Cross Site Scripting XSS vulnerability. In file Controller.class.php, the exit function will terminate the script and print the message to the user. The message will contain $GETC'VARJSONPHANDLER' then there is a XSS vulnerability...
Workerman-ThinkPHP-Redis 跨站脚本漏洞
Workerman-ThinkPHP-Redis is an open source project consisting of the Workerman framework, the ThinkPHP framework, and Redis.Workerman-ThinkPHP-Redis is vulnerable to a cross-site scripting vulnerability that originates in the file Controller.class.php, where the exit function will terminate the...
Exploit for Out-of-bounds Read in Nxp Lpc55S69Jbd100_Firmware
CVE-2021-40154...
resteasy: Error message exposes endpoint class information
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...
Code injection
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...
OX App Suite / Ox Documents 7.10.x XSS / Code Injection / Traversal Vulnerability
OX App Suite and OX Documents suffer from cross site scripting, code injection, path traversal, and input validation vulnerabilities. Most of these issues affect 7.10.5 and below with one affecting 7.10.4 and below. Product: OX App Suite, OX Documents Vendor: OX Software GmbH Internal reference:...
Ivanti Avalanche EnterpriseServer Service Exposed Dangerous Function Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetUser class. The issue results from the lack of authentication prior to allowing...
Ivanti Avalanche EnterpriseServer Service SQL Injection Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SettingsDaoImpl class. A...
RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7 (Moderate) (RHSA-2021:4676)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4676 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...
Jenkins Performance XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Jenkins Performance. Authentication is required to exploit this vulnerability. The specific flaw exists within the TaurusParser class. Due to the improper restriction of XML External Entity X...
Jenkins pom2config XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Jenkins pom2config. Authentication is required to exploit this vulnerability. The specific flaw exists within the Pom2Config class. Due to the improper restriction of XML External Entity XXE...
resteasy: Error message exposes endpoint class information
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...
Cross-Site Request Forgery (CSRF)
showdoc/showdoc is vulnerable to cross-site request forgery. An attacker can add arbitrary members to the team through the register function in UserController.class.php...
Flex Local Fonts <= 1.0.0 - Admin+ Stored Cross-Site-Scripting
The plugin does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Add a new font Tools -- Local Fonts -- Add Font, need to have at least one font for the 'A...
showdoc 跨站请求伪造漏洞
ShowDoc is an open source tool for IT teams to share documents online. ShowDoc is vulnerable to cross-site request forgery, which stems from the lack of effective filtering and restriction of cookies set in the software's UserController.class.php, and can be exploited by attackers to cause...