17647 matches found
CVE-2020-4953
IBM Planning Analytics 2.0 is affected by CVE-2020-4953, an information-disclosure vulnerability where a remote authenticated attacker could obtain internal-structure details via sensitive data exposed in HTTP responses. Root cause: information disclosure due to exposed data in HTTP responses. Ex...
HFS (HTTP File Server) 2.3.x - Remote Command Execution (3)
Exploit Title: HFS HTTP File Server 2.3.x - Remote Command Execution 3 Google Dork: intext:"httpfileserver 2.3" Date: 20/02/2021 Exploit Author: Pergyz Vendor Homepage: http://www.rejetto.com/hfs/ Software Link: https://sourceforge.net/projects/hfs/ Version: 2.3.x Tested on: Microsoft Windows...
CVE-2020-27768
CVE-2020-27768 is an ImageMagick vulnerability: an out-of-range value in unsigned int in MagickCore/quantum-private.h. Affected are ImageMagick versions prior to 7.0.9-0. This issue can be mitigated by upgrading to ImageMagick 7.0.9-0 or later (the patch fixes the unsigned int range/overflow cond...
CVE-2021-27549
Genymotion Desktop (up to 3.2.0) leaks the host clipboard data to the Android application by default. The issue is due to this default behavior, which the vendor states can be changed via Settings > Device screen. Connected sources confirm the affected version range and the remediation path: a...
CVE-2021-27516
CVE-2021-27516 affects the URI.js (urijs) library prior to v1.19.6. The issue stems from how the library handles backslashes in the URL delimiter (e.g., https:/...), which can cause hostname spoofing and misinterpretation of the target hostname, potentially enabling SSRF, open redirects, or relat...
File Upload Vulnerability in ECM Collaboration Management Platform
Micro macro ECM collaborative office OA and collaborative management platform is to enhance enterprise execution, creativity, learning, cohesion, control, decision-making, resilience of the seven forces of collaboration as the goal, to meet the enterprise personalized, refined, mobile management...
CVE-2021-22703
CVE-2021-22703 affects Schneider Electric PowerLogic devices: ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800. The issue is CWE-319 Cleartext transmission of sensitive information, enabling disclosure of user credentials if an attacker intercepts HTTP traffic between...
CVE-2021-25296
creationtimestamp| type| source ---|---|--- 2021-02-15 16:46:41+00:00| seen| https://t.me/cibsecurity/23591 2021-04-27 13:43:41+00:00| seen| MISP/5aa0b3ce-e9c4-4a1d-b95b-4e232c7929fc 2023-02-07 21:54:12+00:00| seen|...
mHealth Apps Expose Millions to Cyberattacks
Some 23 million mobile health mHealth application users are exposed to application programming interface API attacks that could expose sensitive information, according to researchers. Generally speaking, APIs are an intermediary between applications that defines how they can talk to one another a...
Weak Password Vulnerability in Tianqing Hanma USG Firewall of Beijing Qixing Information Security Technology Co.
Tianqing Hanma USG Firewall is a new firewall series product launched by Qixing. There is a weak password vulnerability in Tianqing Hanma USG Firewall, which can be exploited by attackers to obtain sensitive information...
CVE-2021-21017
CVE-2021-21017 affects Adobe Acrobat/Reader (DC Continuous and prior releases) with a heap-based buffer overflow that could allow arbitrary code execution in the user’s context after opening a malicious file. The linked exploit analyses describe a flaw in URL/baseURL handling within PDFs (potenti...
Multiple Embedded TCP/IP Stacks (Update B)
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Multiple Equipment: Nut/Net, CycloneTCP, NDKTCPIP, FNET, uIP-Contiki-OS, uC/TCP-IP, uIP-Contiki-NG, uIP, picoTCP-NG, picoTCP, MPLAB Net, Nucleus NET, Nucleus ReadyStart Vulnerabilities: Use of...
SQL Injection Vulnerabilities in the Website Building System of Guangzhou Benying Computer Technology Co.
Guangzhou Benying Computer Technology Co., Ltd. is committed to building the Internet business ecosystem, especially focusing on the field of mobile Internet, to provide APP development, system development, small program and WeChat public number secondary development, website construction and oth...
Online Marriage Registration System 1.0 Remote Code Execution
Exploit Title: Online Marriage Registration System OMRS 1.0 - Remote code execution 3 Date: 10/02/2021 Exploit Author: Ricardo Ruiz @ricardojoserf Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/online-marriage-registration-system-using-php-and-mysql/ Version: 1.0...
CVE-2021-23878
CVE-2021-23878 affects McAfee Endpoint Security for Windows prior to 10.7.0 (Feb 2021 Update). The issue is clear-text storage of sensitive information in memory, enabling a local user to view ENS settings and credentials by reading process memory shortly after an administrator applies a configur...
CVE-2021-26952
CVE-2021-26952 affects the Rust crate ms3d prior to 0.1.3. The issue arises when IoReader::read processes data into an uninitialized buffer, allowing an attacker to obtain sensitive information from memory. The root cause is passing an uninitialized buffer to a user-provided Read implementation, ...
CVE-2020-17433
Foxit Studio Photo vulnerable in CMP file parsing leading to an out-of-bounds read in Foxit Studio Photo 3.6.6.922 (and affected earlier versions per CNVD). The flaw arises from insufficient validation of user-supplied data, allowing an attacker to read past the end of an allocated structure and ...