CVE-2020-24140

Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services...

CVE-2020-24139

Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services...

Cisco Cisco Self Care Portal 安全漏洞

Cisco Unified Communications Manager is the powerful call processing component of the Cisco Unified Communications solution. It is a scalable, distributable, and highly available enterprise Voice over IP call processing solution.Cisco Unified Communications Manager Session Management Edition is t...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow. There's a flaw in the zeromq server in versions before 4.3.3 in src/decoderallocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A...

The vulnerability of the OpenType Font Parsing component in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the OpenType Font Parsing component in Windows operating systems is related to improper handling of code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted request...

The vulnerability in the web-based administration panel of Microprogramming software for Netgear ProSafe Plus JGS516PE and ProSAFE Plus GS116Ev2 allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the web-based administration panel of Netgear ProSafe Plus JGS516PE and ProSAFE Plus GS116Ev2 networking devices is related to insufficient verification of input parameters. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary cod...

The vulnerability of the DCHP server configuration of Netgear ProSafe Plus JGS516PE and ProSAFE Plus GS116Ev2 network devices allows a hacker to cause a service failure.

The vulnerability of the DCHP configuration of Netgear ProSafe Plus JGS516PE and ProSAFE Plus GS116Ev2 networking devices relates to insufficient cleaning of special elements in the output data used by the incoming component. Exploiting this vulnerability can allow a malicious actor to trigger...

CVE-2021-1356

Multiple vulnerabilities in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to cause the web UI software to become unresponsive and consume vty line instances, resulting in a denial of service DoS condition. These vulnerabilities are due...

Cisco IOS XE Software 路径遍历漏洞

Cisco IOS XE is a set of modular operating system based on Linux kernel developed by Cisco for its network equipment. A command injection vulnerability exists in the web UI of Cisco IOS XE. The vulnerability stems from insufficient input validation. An attacker can exploit this vulnerability by...

Cisco IOS XE Software 输入验证错误漏洞

Cisco IOS XE is a set of modular operating system based on Linux kernel developed by Cisco for its network equipment. A denial of service vulnerability exists in the web UI of Cisco IOS XE. The vulnerability stems from insufficient error handling in the web UI. An attacker can exploit this...

Cisco IOS XE SD-WAN Software 路径遍历漏洞

Cisco IOS XE is a set of modular operating system based on Linux kernel developed by Cisco for its network equipment. A path traversal vulnerability exists in the CLI for SD-WAN in Cisco IOS XE. The vulnerability stems from insufficient validation of user-supplied input. An attacker could exploit...

PT-2021-2452 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: The issue is due to insufficient error handling in the web UI of Cisco IOS XE Software, allowing an authenticated, remote attacker with read-only privileges to cause the web U...

OPENSUSE-SU-2021:0443-1 Security update for privoxy

This update for privoxy fixes the following issues: Update to version 3.0.32: - Security/Reliability boo1183129 - ssplit: Remove an assertion that could be triggered with a crafted CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua Rogers Opera - cgisendbanner:...

pki-core: XSS in the certificate search results

A flaw was found in pki-core. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting XSS attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity...

ExpressVPN Router 输入验证错误漏洞

ExpressVPN Router is a VPN router from ExpressVPN UK. It provides a protected network communication feature. ExpressVPN Router suffers from an input validation error vulnerability that originates from an integer buffer overflow in the Nginx web server, which can be exploited by an attacker to...

Multiple Plugins - CSRF Nonce Bypasses

Multiple plugins did not properly check for CRSF nonces, allowing attackers to make logged in users do unwanted actions with crafted requests not containing the related nonce parameter. Other plugins reported in the original advisory which are not here have been added individually in the last wee...

The vulnerability of the Page Info component in the Google Chrome web browser allows attackers to perform spoofing attacks using a specially created request.

The vulnerability of the Page Info component in the Google Chrome web browser is related to the bypassing of authentication processes through spamming. Exploiting this vulnerability allows a malicious actor to carry out spamming attacks using a specially created request...

USN-4740-1: Apache Shiro vulnerabilities

It was discovered that Apache Shiro mishandled specially crafted requests. An attacker could use this vulnerability to bypass authentication mechanisms...

USN-4740-1 shiro vulnerabilities

It was discovered that Apache Shiro mishandled specially crafted requests. An attacker could use this vulnerability to bypass authentication mechanisms...

Soabase Exhibitor UI Config Command Injection (CVE-2019-5029)

A command injection vulnerability exists in Soabase Exhibitor, an open source project from Netflix. The vulnerability is due to improper validation of user-supplied input in the Config tab of Exhibitor web interface. A remote unauthenticated attacker can exploit the vulnerability by sending craft...