Sipwise C5 NGCP CSC - Click2Dial Cross-Site Request Forgery (CSRF)

Exploit Title: Sipwise C5 NGCP CSC - Click2Dial Cross-Site Request Forgery CSRF Date: 13.04.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.sipwise.com Sipwise C5 NGCP CSC CSRF Click2Dial Exploit Vendor: Sipwise GmbH Product web page: https://www.sipwise.com Affected version:...

Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. This vulnerability is due to insufficient input validation by the web-based management...

PT-2021-2863 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: The issue is related to errors in the authorization procedure of the Cisco SD-WAN vManage web interface. It allows a remote attacker to gain unauthorized access to...

SUSE: Security Advisory (SUSE-SU-2018:3963-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Server-Side Request Forgery (SSRF)

matrixsydent is vulnerable to server-side request forgery SSRF. An attacker is able to send HTTP GET requests on behalf of the server to internal systems due to lack of parameter validation or IP address blacklisting...

OpenClinic GA SQL Injection Vulnerability (CNVD-2021-29426)

OpenClinic GA is an open source hospital integrated information management system . An SQL injection vulnerability exists in the description parameter in getAssets.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injectio...

OpenClinic GA SQL Injection Vulnerability (CNVD-2021-29432)

OpenClinic GA is an open source hospital integrated information management system . An SQL injection vulnerability exists in the code parameter in getAssets.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injection attac...

CVE-2021-29430

Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it...

Design/Logic Flaw

Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it...

Command injection

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system...

Rukovoditel SQL Injection Vulnerability (CNVD-2021-28755)

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . Rukovoditel Project Management App 2.7.2 suffers from a SQL injection vulnerability that can be trigger...

OpenClinic GA SQL注入漏洞

OpenClinic GA is an open source hospital integrated information management system . An SQL injection vulnerability exists in the serviceuid parameter in getAssets.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injection...

OutSystems Platform Server Server Cross-Site Request Forgery Vulnerability

Outsystems OutSystems Platform is a set of enterprise-level low-code development platform from OutSystems Outsystems. The platform is mainly used for the visual development of applications. A server cross-site request forgery vulnerability exists in OutSystems Platform Server, which can be...

CVE-2021-29357

The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 and LifeTime management console before 11.7.0 allows SSRF for arbitrary outbound HTTP requests...

Server side request forgery (ssrf)

The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 and LifeTime management console before 11.7.0 allows SSRF for arbitrary outbound HTTP requests...

CVE-2021-29357

The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 and LifeTime management console before 11.7.0 allows SSRF for arbitrary outbound HTTP requests...

CVE-2021-29357

The CVE-2021-29357 issue is tied to OutSystems Platform Server’s ECT Provider component. Affected versions : OutSystems Platform Server 10 prior to 10.0.1104.0 and 11 prior to 11.9.0, as well as LifeTime management console prior to 11.7.0. Vulnerability : Server-side request forgery (SSRF) enable...

CVE-2021-1415

Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code with elevated privileges equivalent to the web service process on an affected device. These...

CVE-2021-1414

Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code with elevated privileges equivalent to the web service process on an affected device. These...

CVE-2021-1413

Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code with elevated privileges equivalent to the web service process on an affected device. These...