WordPress plugin 访问控制错误漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. An access control error vulnerability exists in versions of Wordpress Plugin Protect WP Admin prior to...

CVE-2021-33966

Cross site scripting XSS vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page...

VulnCheck KEV: CVE-2021-32648

In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request...

keycloak-server-spi-private: ECP SAML binding bypasses authentication flows

A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The...

CVE-2021-42357

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...

CVE-2021-38965

IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 212346...

httpd: mod_lua: Possible buffer overflow when parsing multipart content

A buffer overflow flaw in httpd's lua module could allow an out-of-bounds write. An attacker who is able to submit a crafted request to an httpd instance that is using the lua module may be able to cause an impact to confidentiality, integrity, and/or availability...

CVE-2021-38965

IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 212346...

The vulnerability of the Microsoft Dynamics 365 Business Central software for small and medium-sized businesses lies in improper code generation, allowing an attacker to execute arbitrary code.

The vulnerability of the Microsoft Dynamics 365 Business Central software for small and medium-sized businesses is related to improper code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted request...

Cisco Unified Contact Center Management Portal和Cisco Unified Contact Center Domain Manager 安全漏洞

Cisco Unified Contact Center Management Portal and Cisco Unified Contact Center Domain Manager are both products of Cisco Corporation. Management Portal is an intuitive and secure Web-based application that allows supervisors and managers to meet the complex and changing demands of the contact...

PT-2022-1436 · Cisco · Cisco Tetration

Name of the Vulnerable Software and Affected Versions: Cisco Tetration affected versions not specified Description: The issue is related to insufficient input validation in the web-based management interface and API subsystem, allowing an authenticated, remote attacker to inject arbitrary command...

The vulnerability of the threat detection mechanism for Microsoft Defender for IoT, related to improper code generation, allows a malicious actor to execute arbitrary code.

The vulnerability of the Microsoft Defender for IoT threat detection mechanism is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially crafted request...

The vulnerability of Microsoft SharePoint Server and Microsoft SharePoint packages lies in improper code generation management, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft SharePoint Server packages is related to improper code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code through a specially crafted request...

The vulnerability of the threat detection mechanism for Microsoft Defender for IoT, related to improper code generation, allows a malicious actor to execute arbitrary code.

The vulnerability of the Microsoft Defender for IoT threat detection mechanism is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially crafted request...

PT-2022-1571 · Microsoft · Windows Refs +1

Name of the Vulnerable Software and Affected Versions: Windows Resilient File System ReFS affected versions not specified Description: The issue is related to errors in code generation management in the Resilient File System ReFS of Windows operating systems. It allows remote attackers to execute...

PT-2022-1569 · Microsoft · Windows Resilient File System +1

Name of the Vulnerable Software and Affected Versions: Windows Resilient File System ReFS affected versions not specified Description: The issue is related to errors in code generation management in the Windows Resilient File System ReFS. It can be exploited by sending a specially crafted request...

PT-2022-1568 · Microsoft · Windows Resilient File System +1

Name of the Vulnerable Software and Affected Versions: Windows Resilient File System ReFS affected versions not specified Description: The issue is related to errors in code generation management in the Windows Resilient File System ReFS. It can be exploited by sending a specially crafted request...

The vulnerability of the Media Foundation component in Microsoft Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Media Foundation component in Microsoft Windows operating systems is related to improper code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted request...

Link Library < 7.2.8 - Unauthenticated Arbitrary Links Deletion

The plugin does not have authorisation in place when deleting links, allowing unauthenticated users to delete arbitrary links via a crafted request PoC https://example.com/?posttype=linklibrarylinks&ll60reupdate;=1...

The vulnerability of the Apache HTTP server, related to the occurrence of out-of-bound operations in memory, allows attackers to execute arbitrary code.

The vulnerability of the Apache HTTP server is related to the execution of operations outside the memory buffer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted HTTP request...