EulerOS 2.0 SP9 : python-urllib3 (EulerOS-SA-2021-2565)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF...

EulerOS 2.0 SP9 : python-urllib3 (EulerOS-SA-2021-2541)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF...

Gradle Enterprise deserialization vulnerability

Gradle Enterprise improves developer productivity by accelerating builds, improving build reliability, and speeding up build debugging.A deserialization vulnerability exists in versions of Gradle Enterprise prior to 2021.1.3. An attacker could exploit this vulnerability to achieve remote code...

Gradle Enterprise Information Disclosure Vulnerability (CNVD-2021-89946)

Gradle Enterprise can improve developer productivity by accelerating builds, improving build reliability, and speeding up build debugging. An attacker could exploit this vulnerability to obtain potentially sensitive build/configuration details via a specially crafted HTTP request with the...

Server-Side Request Forgery (SSRF) in collectiveaccess/providence

Description Authenticated, blind SSRF vulnerability exists in CollectiveAccess. Requires edit access tested with default cataloguer account Proof of Concept As the 'cataloguer', user: Step 1. Create a new object with the title: Step 2. After submitting this object, browse for objects in...

CVE-2021-40309

A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to inject their own SQL query. The cpidmissattn parameter from TakeAttendance.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request as a user with...

CVE-2021-40309

A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to inject their own SQL query. The cpidmissattn parameter from TakeAttendance.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request as a user with...

Sql injection

A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to inject their own SQL query. The cpidmissattn parameter from TakeAttendance.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request as a user with...

CVE-2021-41584

Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response information disclosure of possibly sensitive build/configuration details via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Request header...

CVE-2021-31923

Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation...

Design/Logic Flaw

Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation...

Cross site request forgery (csrf)

Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response information disclosure of possibly sensitive build/configuration details via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Request header...

CVE-2021-41584

Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response information disclosure of possibly sensitive build/configuration details via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Request header...

CVE-2021-31923

Ping Identity PingAccess before 5.3.3 is affected by an HTTP request smuggling vulnerability via header manipulation. The CVE-2021-31923 entry is corroborated by multiple sources (NVD, Red Hat advisory, CVE records) indicating the issue lies in PingAccess prior to version 5.3.3. The available doc...

CVE-2021-31923

Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation...

VMware vCenter Server Path Traversal Vulnerability

Vmware VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructure. vCenter Server is vulnerable to a...

Ping Identity PingAccess 环境问题漏洞

Ping Identity PingAccess is a centralized access security solution with a comprehensive policy engine from Ping Identity, Inc. It is used to provide secure access to applications and Api's up to the Url level and ensures that only authorized users can access the resources they need. A security...

EulerOS 2.0 SP8 : python-urllib3 (EulerOS-SA-2021-2485)

According to the versions of the python-urllib3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF...

VMware vCenter Server Denial of Service Vulnerability (CNVD-2021-74281)

Vmware VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. vmware vCenter Server is...

Simple Attendance System 1.0 - Unauthenticated Blind SQLi

Exploit Title: Simple Attendance System 1.0 - Unauthenticated Blind SQLi Exploit Author: t//\1 Date: September 21, 2021 Vendor Homepage: https://www.sourcecodester.com/php/14948/simple-attendance-system-php-and-sqlite-free-source-code.html Tested on: Linux Version: v1.0 Exploit Description: The...