CVE-2021-39124

The Cross-Site Request Forgery CSRF failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are able to trick a user into retrying a request to bypass CSRF protection and replay a crafted request...

Design/Logic Flaw

It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG OTRS Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions...

The vulnerability of the print spooler driver for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Windows Print Spooler in operating systems related to the print queue management process is associated with improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created request...

Cisco Application Policy Infrastructure Controller 授权问题漏洞

Cisco Application Policy Infrastructure Controller APIC is an automated infrastructure deployment and governance solution from Cisco. The API endpoint of the Controller contains an elevation of privilege vulnerability that can be exploited by an attacker with administrator read-only credentials t...

The vulnerability of the SFCB service (Small Footprint CIM Broker), which is part of the VMware ESXi hypervisor and the VMware Cloud Foundation virtualization platform, allows a perpetrator to bypass the authentication process.

The vulnerability of the SFCB Small Footprint CIM Broker service of the VMware ESXi hypervisor and the VMware Cloud Foundation virtualization platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication...

CVE-2020-25359

An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers the ability to send a crafted request to /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php by specifying a path in the path parameter and an extension in the ext parameter and delet...

CVE-2020-25351

An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote authenticated attackers to read files on the system via a crafted request sent to to the /lib/crud/configcompare.crud.php script...

CVE-2020-25351

An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote authenticated attackers to read files on the system via a crafted request sent to to the /lib/crud/configcompare.crud.php script...

The vulnerability of the Graphics Component in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Graphics Component component in Windows operating systems is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted request...

rConfig 安全漏洞

rConfig is an open source network configuration management utility. rConfig is vulnerable due to an arbitrary file deletion vulnerability in rConfig 3.9.5. An attacker could use the vulnerability to send a crafted request to /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php by specifying a path in...

PT-2021-11130 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig versions 3.9.5 Description: An arbitrary file deletion issue allows attackers to delete files by sending a crafted request to "/lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php" and specifying a path in the path parameter and an extensi...

Design/Logic Flaw

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1.2 and below, 5.0.3 and below, 4.2.2 and below, 4.1.2 and below, 4.0.4 and below may allow a remote and unauthenticated attacker to perform ...

CVE-2021-33193

A crafted method sent through HTTP/2 will bypass validation and be forwarded by modproxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48...

CVE-2021-37351

Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server...

CVE-2021-37351

Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server...

Nagios XI 权限许可和访问控制问题漏洞

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting, and rich data visualization.An insecure privilege vulnerability exists in versions of Nagios XI prior to 5.8.5. An attacker could exploit the vulnerability by...

spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack

A flaw was found in spring-cloud-config in versions prior to 2.1.9 and 2.2.3. Applications are allowed to serve arbitrary configuration files through the spring-cloud-config-server module allowing an attacker to send a request using a specially crafted URL to create a directory traversal attack...

PT-2021-3885 · Microsoft · Dynamics 365

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 affected versions not specified Description: The issue is related to incorrect code generation management in Microsoft Dynamics 365, allowing a remote attacker to execute arbitrary code by sending a specially crafted...

PT-2021-3924

Name of the Vulnerable Software and Affected Versions Windows Services for NFS ONCRPC XDR Driver affected versions not specified Description The issue is related to incorrect code generation management in the NFS ONCRPC XDR driver for Microsoft Windows operating systems. It allows a remote attack...

D-Link多款产品代码问题漏洞

The D-Link DAP-2310 is a single-band wireless network access point for small businesses or schools that need a fast and reliable wireless network. the DAP-2330 is a wireless N300 single-band PoE access point. A null pointer dereference vulnerability exists in several D-Link products. The...