CVE-2021-28566

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated...

Authorization

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for...

Information disclosure

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated...

CVE-2021-28567

The CVE-2021-28567 entry concerns Magento Commerce/Open Source with an Improper Authorization flaw in the customers module. Affected versions include Magento 2.4.2 and earlier, 2.4.1-p1 and earlier, and 2.3.6-p1 and earlier. The vulnerability allows a low-privileged user to modify customer data, ...

The vulnerability in the Intel Raid Web Console 3 relates to incorrect default access settings, allowing attackers to increase their privileges.

The vulnerability of the Intel Raid Web Console 3 web console relates to incorrect default access settings. Exploiting this vulnerability can allow attackers to gain increased privileges...

CVE-2021-3546[78]: Akkadian Console Server Vulnerabilities (FIXED)

!CVE-2021-3546\78: Akkadian Console Server Vulnerabilities \FIXED\https://blog.rapid7.com/content/images/2021/09/akkadian-vuln.jpg Over the course of routine security research, Rapid7 researchers Jonathan Peterson, Cale Black, William Vu, and Adam Cammack discovered that the Akkadian Console ofte...

The vulnerability of the Admin Console console for Oracle WebLogic Server applications allows attackers to execute cross-site scripting attacks.

The vulnerability of the Admin Console console of Oracle WebLogic Server applications relates to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Antminer Monitor 0.5.0 - Authentication Bypass Vulnerability

Exploit Title: Antminer Monitor 0.5.0 - Authentication Bypass Dork:https://www.zoomeye.org/searchResult?q=%22antminer%20monitor%22 Exploit Author: CQR.company / Vulnz. Vendor Homepage: https://github.com/anselal/antminer-monitor, https://twitter.com/intent/follow?screenname=AntminerMonitor Softwa...

CVE-2021-35218

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server...

CVE-2021-35218

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server...

Deserialization of untrusted data

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server...

CVE-2021-35218 Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server...

CVE-2021-35218

CVE-2021-35218 affects the SolarWinds Patch Manager Web Console Chart Endpoint. The root cause is deserialization of untrusted data, leading to remote code execution. An attacker with network access can exploit this (authentication is required in some advisories, but bypass is noted in at least o...

Rundeck Cross-Site Request Forgery Vulnerability

Rundeck is an open source automation service with a web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. a cross-site request forgery vulnerability exists in Rundeck, which stems from the fact that users with access to the "system" resource...

Solarwinds Orion Patch Manager Web Console 代码问题漏洞

solarwinds Patch Manager is an application from solarwinds, Inc. It is used to manage third-party software. A security vulnerability exists in the Solarwinds Orion Patch Manager Web Console that stems from. deserialization of untrusted data in the Web Console chart endpoint could lead to remote...

Cross site scripting

A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECTProvider/, such that when the content is viewed it can only be...

CVE-2021-39133

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all...

Cross site request forgery (csrf)

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all...

Authentication flaw

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with ...

CVE-2021-39133

Summary: CVE-2021-39133 affects Rundeck; prior to versions 3.3.14 and 3.4.3 a user with admin access to the system resource type could be CSRF-ed into causing the server to run untrusted code. The issue exposes all Rundeck editions to potential code execution via CSRF. Affected versions: Rundeck ...