Photon OS 1.0: Pyyaml PHSA-2021-1.0-0361

An update of the PyYAML package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0361. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid14677...

Kangtaike SolarView Compact SV-CPT-MC310 Path Traversal Vulnerability

Kangtaike SolarView Compact is an application from Kangtaike Japan Inc. which provides photovoltaic power measurement systems. Kangtaike SolarView Compact SV-CPT-MC310 suffers from a path traversal vulnerability that could be exploited by an attacker to delete arbitrary files and/or directories o...

Kangtaike SolarView Compact SV-CPT-MC310 Arbitrary File Upload Vulnerability

Kangtaike SolarView Compact is an application system from Kangtaike Japan Inc. Kangtaike SolarView Compact SV-CPT-MC310 contains an arbitrary file upload vulnerability that can be exploited by attackers to upload arbitrary files via an unspecified carrier...

CVE-2021-25297

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command...

SUSE SLED15 / SLES15 Security Update : openvswitch (SUSE-SU-2021:0436-1)

This update for openvswitch fixes the following issues : CVE-2020-35498: Fixed a denial of service related to the handling of Ethernet padding bsc1181742. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempt...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2022-09274)

ZOHO ManageEngine Applications Manager is an IT operations management solution from ZOHO, Inc. Zoho ManageEngine Applications Manager through 14930 is vulnerable to SQL injection, which can be exploited to perform an authenticated SQL injection into showresource.do via the resourceid parameter...

CVE-2020-18717

SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzztemplate.php...

CVE-2020-2507

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3...

CVE-2020-2506

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk...

Command injection

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3...

Improper access control

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk...

CVE-2020-2506

CVE-2020-2506 affects QNAP Systems Inc. Helpdesk prior to version 3.0.3, due to improper access control that could allow an attacker to gain privileges or read sensitive information. The issue is documented across multiple sources (NVD, CNVD, CVELIST, PT-Security, Nessus QSA-20-08) and is referen...

CVE-2020-2506 improper access control vulnerability in Helpdesk

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk...

CVE-2020-2507 command injection vulnerability in Helpdesk

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3...

CVE-2020-2507

CVE-2020-2507 is a command injection vulnerability in QNAP QTS Helpdesk prior to version 3.0.3. Exploitation could allow remote attackers to execute arbitrary commands with no authentication, as reported in multiple sources. The issue is tied to Helpdesk (improper access control) and is reference...

CVE-2020-28144

Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware Version 5.5 or lower, and EDR-810 Series Firmware Version 5.6 or lower. Crafted requests sent to the device may allow remote arbitrary code...

Design/Logic Flaw

Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware Version 5.5 or lower, and EDR-810 Series Firmware Version 5.6 or lower. Crafted requests sent to the device may allow remote arbitrary code...

CVE-2020-28144

Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware Version 5.5 or lower, and EDR-810 Series Firmware Version 5.6 or lower. Crafted requests sent to the device may allow remote arbitrary code...

CVE-2020-28144

The CVE-2020-28144 entry concerns Moxa EDR-G903 (Firmware ≤ 5.5), EDR-G902 (Firmware ≤ 5.5), and EDR-810 (Firmware ≤ 5.6). The vulnerability is due to an improper restriction of operations, where crafted requests may enable remote arbitrary code execution. The connected sources confirm the affect...

CVE-2021-23271

The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting XSS attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX:...