Pimcore 安全漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A path traversal vulnerability exists in versio...

The vulnerability of the built-in software of the ARIS controller is related to deficiencies in the authentication process, allowing a perpetrator to execute arbitrary code.

The vulnerability of the built-in software of the ARIS controller is related to deficiencies in the authentication process, allowing a perpetrator to execute arbitrary code using a specially crafted request...

Pomerium 安全漏洞

Pomerium is an open source identity-aware access agent from the U.S. company Pomerium. It is used to enable secure access to internal applications. A security vulnerability exists in Pomerium v0.22.1 and earlier versions that stems from the fact that for specially crafted requests, Pomerium may...

Pomerium vulnerable to Incorrect Authorization with specially crafted requests

Impact With specially crafted requests, incorrect authorization decisions may be made by Pomerium. Patches We are releasing patch fixes to address this vulnerability going back to v0.17.X. Please upgrade to: - v0.22.2 - v0.21.4 - v0.20.1 - v0.19.2 - v0.18.1 - v0.17.4 For more information If you...

The vulnerability of the ksmbd module in Linux operating systems allows a hacker to trigger a service failure.

The vulnerability of the ksmbd module in Linux operating systems is related to pointer arithmetic errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions by sending a specially crafted request...

The vulnerability of the GoAhead microprogramming software component of D-Link DIR-823G routers allows a hacker to execute arbitrary commands.

The vulnerability of the GoAhead microprogramming software for D-Link DIR-823G routers exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through...

CVE-2022-36326

An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi a...

VulnCheck KEV: CVE-2017-3506

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document...

The vulnerability of the Core component of the Oracle Health Sciences InForm software for clinical testing allows a hacker to gain access to data and manipulate it.

The vulnerability of the Core component of the Oracle Health Sciences InForm software for clinical testing exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to data and manipulate it using a specially craft...

The vulnerability in the web interface for managing Netgear SRX5308 microprogramming software routers allows attackers to perform cross-site scripting attacks.

The vulnerability in the web interface for managing Netgear SRX5308 microprogramming software routers is related to insufficient protection of the web page structure when processing the Login.userAgent parameter. Exploiting this vulnerability allows a remote attacker to perform cross-site scripti...

The web interface of Netgear’s SRX5308 router software has vulnerabilities that allow attackers to carry out cross-site scripting attacks.

The vulnerability in the web interface of Netgear’s SRX5308 router software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to carry out a cross-site scripting attack by sending a specially crafted HTTP request...

The vulnerability of the API scripts api_jsonrpc.php and index.php of the universal monitoring system Zabbix allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the API JSON RPC.php and index.php implementations of the Zabbix monitoring system is related to the exposure of information due to inconsistencies. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected...

CVE-2023-22640

A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS version 6.2.0 through 6.2.13, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7,...

Cross site scripting

A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS version 6.2.0 through 6.2.13, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7,...

Out-of-bound-write in sslvpnd

An out-of-bounds write vulnerability CWE-787 in sslvpnd of FortiOS and FortiProxy may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted requests...

Fortinet Fortigate Out-of-bound-write in sslvpnd (FG-IR-22-475)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-475 advisory. - A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS versio...

CVE-2023-30467

This vulnerability exists in Milesight 4K/H.265 Series NVR models MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC, due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially...

CVE-2023-30466

This vulnerability exists in Milesight 4K/H.265 Series NVR models MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC, due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a...

SmartDNS 缓冲区错误漏洞

SmartDNS is a DNS server running locally by Nick Peng Personal Developer. A security vulnerability exists in SmartDNS version v41 and prior versions, which stems from the presence of a stack-based buffer overflow that allows out-of-bounds writes via specially crafted DNS requests...

CVE-2021-44465

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests...