CVE-2021-42192

Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation...

KONGA 安全漏洞

KONGA is a full-featured, open source, multi-user GUI from the Dutch individual developer Panagis Tselentis. A security vulnerability exists in KONGA version v0.14.9 that stems from incorrect access control. An attacker can exploit this vulnerability to elevate privileges via a specially crafted...

CVE-2022-20744 Cisco Firepower Management Center Software Information Disclosure Vulnerability

A vulnerability in the input protection mechanisms of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to view data without proper authorization. This vulnerability exists because of a protection mechanism that relies on the existence or values of a...

GHSA-5CW4-GGX9-36VG Apache Tomcat Denial of Service via Malformed Request Headers

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and modjk load balancing are used, allows remote attackers to cause a denial of service application outage via a crafted request with invalid headers, related to temporary blocking of...

Cisco Firepower Management Center Software Information Disclosure Vulnerability

A vulnerability in the input protection mechanisms of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to view data without proper authorization. This vulnerability exists because of a protection mechanism that relies on the existence or values of a...

CVE-2021-36203

The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request...

Cross site request forgery (csrf)

The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request...

CVE-2021-36203 Johnson Controls Metasys SCT Pro

The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request...

Typo3 Authentication Bypass

TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request...

CVE-2022-20805

A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway SWG could allow an authenticated, adjacent attacker to bypass the SSL decryption and content filtering policies on an affected system. This vulnerability is due to how the decryption function uses the TLS Sev...

Design/Logic Flaw

A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway SWG could allow an authenticated, adjacent attacker to bypass the SSL decryption and content filtering policies on an affected system. This vulnerability is due to how the decryption function uses the TLS Sev...

Cisco Umbrella Secure Web Gateway File Decryption Bypass Vulnerability

A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway SWG could allow an authenticated, adjacent attacker to bypass the SSL decryption and content filtering policies on an affected system. This vulnerability is due to how the decryption function uses the TLS Sev...

Atlassian Jira 授权问题漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. Atlassian Jira suffers from an authorization issue vulnerability that can be exploited by an attacker to bypass authentication b...

The vulnerability of the /cloud_config/cloud_device/info function in TP-LINK’s WR-886N router software allows a attacker to execute arbitrary code.

The vulnerability of the /cloudconfig/clouddevice/info function in TP-LINK’s WR-886N router software arises due to buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially crafted request...

CVE-2022-21145

A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-44375

Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-40405

A denial of service vulnerability exists in the cgiserver.cgi Upgrade API functionality of Reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2021-40390

An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP request can lead to unauthorized access. An attacker can send an HTTP request to trigger this vulnerability...

Apache Pinot Denial of Service Vulnerability

Apache Pinot is a real-time distributed OLAP data store from the Apache Foundation, Inc. Designed to provide ultra-low latency analysis, Apache Pinot 0.9.3 and earlier versions contain a denial-of-service vulnerability that could be exploited by an attacker to cause a Pinot service outage via a...

HTTP Request Smuggling (HRS)

twisted is vulnerable to http request smuggling. The vulnerability exists in twisted.web due to inconsistent interpretation of http requests which allows a remote attacker to conduct HTTP request smuggling attacks via a crafted request...