CVE-2021-3043

CVE-2021-3043 describes a reflected XSS vulnerability in the Prisma Cloud Compute web console that could allow an authenticated administrator to execute arbitrary JavaScript in the browser. Affected are Prisma Cloud Compute SaaS/on-premises versions: 20.12 prior to 20.12.552 and 21.04 prior to 21...

Shopify: Theme editor `oseid` parameter is leaked to third-party services through the `Referer` header which leads to somekind of storefront password bypass.

Hello Shopify, Summary While reading @danishalkatiri's report 997350, I remembered a report that @francisbeaudoin shared with me some time agomid-February 2021 about leaking the theme editor oseid parameter and being able to exploit it to a point where he was able to somewhat bypass the storefron...

IBM Security Access Manager path traversal vulnerability

IBM Security Access Manager is a product of IBM Corporation for information security management. The product enables access management control through integrated Web-, mobile-, and cloud-oriented devices.IBM Security Access Manager Docker is vulnerable to a path traversal vulnerability that...

CVE-2021-34529

Technical details about CVE-2021-34529 (affected product, root cause, impact, or fixes) are not publicly provided in the connected documents; monitor official advisories and updates for authoritative information.

HuCart v5.7.9 suffers from SQL injection vulnerability

HuCart is a leading enterprise building system, based on PHP Mysql architecture, can run on Linux, Windows and other various server platforms, regular environment, can support millions of data. HuCart v5.7.9 suffers from a SQL injection vulnerability that can be exploited by attackers to obtain...

Perl Detection (HTTP)

HTTP based detection of Perl. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or...

CVE-2020-19715

CVE-2020-19715 is rejected and not active; refer to CVE-2019-13110 instead.

CVE-2021-20422

CVE-2021-20422 affects IBM Cloud Pak for Applications 4.3, where a memory-based information disclosure could allow a malicious attacker to access sensitive user data stored in memory. The CVSS base score is 7.5 (HIGH). The issue is addressed in IBM Cloud Pak for Applications v4.3.1, which provide...

What is (SQLi) SQL Injection❓ — Types, Example and Prevention. Part 1

What is SQLi SQL Injection❓ — Types, Example and Prevention. Part 1 SQL injection concept Data is among the most crucial parts of every information system. Hence, organizations use databases that are fueled by applications on the web to get clients’ information. Now, it’s crucial to properly mana...

CVE-2021-34320

Siemens JT2Go and Teamcenter Visualization are affected prior to version 13.2. The Jt981.dll module fails to validate user-supplied data when parsing JT files, causing an out-of-bounds read that can leak information within the current process. Affected products: JT2Go (all versions < 13.2) and...

CVE-2021-34303

CVE-2021-34303 affects Siemens JT2Go (all versions < 13.2) and Teamcenter Visualization (all versions

CVE-2021-33711

CVE-2021-33711 affects Siemens Teamcenter Active Workspace: V4 prior to 4.3.9, V5.0 prior to 5.0.7, and V5.1 prior to 5.1.4. The vulnerability arises from verbose error messages that leak sensitive information (e.g., full file paths), enabling information disclosure. Public details in connected s...

IBM Security Access Manager 命令注入漏洞

IBM Security Access Manager is a product for information security management applications from IBM, USA. The product enables access management control through integrated devices for web, mobile and cloud computing. A command injection vulnerability exists in IBM Security Access Manager Docker,...

Suricata 安全漏洞

Suricata is a network intrusion detection system IDS, intrusion prevention system IPS and network security monitoring engine developed by the Open Information Security Foundation OISF and its supporting vendors, which supports multi-threading, built-in IPv6, and the ability to load pre-defined...

HackerOne: PII data Leakage through hackerone reports

Summary: I found PII data leakage through the HackerOne report. I found a link in one of the disclosed report that allow me to get the address and phone numbers of security researchers. Here I got the address and phone number of ████ ███ Vulnerability Name: PII data Leakage through Steps to...

CVE-2021-30201

CVE-2021-30201 affects Kaseya VSA (on‑premises/server side) where the API /vsaWS/KaseyaWS.asmx processes XML with external entities. The vulnerability arises from insecure handling of XML external entities, allowing an attacker to cause the server to read local files (e.g., c:\kaseya\kserver\kser...

CVE-2021-30119

CVE-2021-30119 is a Cross-Site Scripting vulnerability in Kaseya VSA (on-premises) that enables authenticated, reflective XSS via the HelpDeskTab/rcResults.asp parameter result and the done.asp FileName parameter. Affected product/version details are referenced across sources (Kaseya VSA

CVE-2021-30117

CVE-2021-30117 affects Kaseya VSA prior to 9.5.6. It is a semi-authenticated boolean-based blind SQL injection in the exportFldr.asp endpoint (fldrId parameter). Connected CVE data confirms the affected product and the vulnerable version range (

Design/Logic Flaw

Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that is accessible in the context of the user executing softwa...

Weak Password Vulnerability in Zhongfu Information Security and Confidentiality Comprehensive Management Platform

Founded in 2002, CDF Information specializes in the research, development, sales and provision of total solutions for information security products. A weak password vulnerability exists in Zung Fu's comprehensive information security and confidentiality management platform, which can be exploited...