Command Execution Vulnerability in TongWeb Management Console

TongWeb is an application server from Beijing Orientop Technology Co. A command execution vulnerability exists in the TongWeb management console that can be exploited by an attacker to execute illegal commands...

CVE-2021-28584

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is...

CVE-2021-28584

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is...

CVE-2021-28563

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

Path traversal

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is...

Authorization

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

CVE-2021-28584

CVE-2021-28584 is a Magento path-traversal vulnerability affecting Magento Commerce/Open Source versions up to 2.4.2, 2.4.1-p1, and 2.3.6-p1. An authenticated admin can exploit a flaw when creating a store with a child theme to perform arbitrary file-system writes. The impact is authenticated acc...

CVE-2021-28584 Magento Commerce path traversal vulnerability in child theme store creation

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is...

CVE-2021-28563

Magento Commerce/Open Source prior to 2.4.3 (specifically 2.4.2 and earlier, 2.4.1-p1 and earlier, 2.3.6-p1 and earlier) is affected by an Improper Authorization vulnerability via the Create Customer endpoint. An unauthenticated attacker could cause unauthorized modification of customer data, wit...

CVE-2021-28563 Magento Commerce improper Authorization via the 'Create Customer' endpoint

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

Pandora FMS Cross-Site Scripting Vulnerability

"Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. through visualization.A stored cross-site scripting vulnerability exists in Pandora FMS 7.54 and earlier versions. An attacker could exploit this...

PS3 Players Ban: Victims of Surging Gaming Attacks

A reported breach of a Sony folder containing the serial ID numbers for every PlayStation 3 console appears to have led to users being inexplicably banned from the platform. This is just the latest in a shocking spike in attacks on unsuspecting gamers. Sony reportedly left a folder with every PS3...

CVE-2021-33528

In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iwconsole functionality. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker...

CVE-2021-35501

PandoraFMS =7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed...

CVE-2021-35501

PandoraFMS =7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed...

Cross site scripting

PandoraFMS =7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed...

CVE-2021-35501

PandoraFMS =7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed...

CVE-2021-35501

Pandora FMS affects

CVE-2021-35501

PandoraFMS =7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed...

CVE-2020-28097

A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles. When a local attacker attempts to scroll the console, calling an ioctl TIOCLSCROLLCONSOLE, an out-of-bounds memory access issue occurs. This flaw allows a local user with access to the VGA console to...