思科 Cisco Webex Meetings 跨站脚本漏洞

Cisco Webex Meetings provides affordable enterprise virtual meeting solutions. A cross-site scripting vulnerability exists in the web interface of Cisco Webex Meetings. The vulnerability stems from insufficient validation of user-supplied input in the web interface of the affected service. An...

QIWI: Remote Code Execution on contactws.contact-sys.com via SQL injection in TAktifBankObject.GetOrder in parameter DOC_ID

Summary The API interface on https://contactws.contact-sys.com:3456/ accepts a body to interact with the server's AppServ object. Because of insufficient input validation, an attacker can abuse the DOCID parameter on the TAktifBankObject operation GetOrder to inject arbitrary SQL statements into...

The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business models RV016, RV042, RV042G, RV082, RV320, and RV325 allows a hacker to execute arbitrary code or cause service failures.

The vulnerability of the web-based management interfaces for Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 lies in insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause service failures...

PT-2021-2172 · Microsoft · Windows Console Driver +1

Name of the Vulnerable Software and Affected Versions: Windows Console Driver affected versions not specified Description: The issue is related to insufficient input validation in the Windows Console Driver, which can be exploited by a remote attacker to cause a denial of service. This can affect...

The vulnerability of the vAnalytics function in the programmatically defined Cisco SD-WAN network allows a attacker to compromise data integrity.

The vulnerability of the vAnalytics function in the programmatically defined Cisco SD-WAN network is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to compromise data integrity from a remote location...

Intel® Server Boards, Server Systems and Compute Modules Advisory

Summary: Potential security vulnerabilities in some Intel® Server Boards, Server Systems and Compute Modules Baseboard Management Controller BMC firmware may allow escalation of privilege or information disclosure. Intel is releasing firmware updates to mitigate these potential vulnerabilities...

Cisco SD-WAN Information Disclosure (cisco-sa-sdwan-infodis-2-UPO232DG)

According to its self-reported version, an information disclosure vulnerability exists in the CLI of Cisco SD-WAN Software due to insufficient input validation of requests that are sent to the iperf tool. An unauthenticated, local attacker can exploit this, by sending a crafted request to the ipe...

PT-2021-2155 · Microsoft · Sharepoint Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: The issue is related to a spoofing vulnerability in Microsoft SharePoint. It is caused by insufficient input validation, which can be exploited by a remote attacker to...

PT-2021-2153 · Microsoft · Windows Dns Server +1

Name of the Vulnerable Software and Affected Versions: Windows DNS Server affected versions not specified Description: The issue is related to insufficient input validation in the Windows DNS Server service. This can be exploited by a remote attacker to execute arbitrary code. Recommendations: At...

PT-2021-2039 · Microsoft · Dataverse

Name of the Vulnerable Software and Affected Versions: Microsoft Dataverse affected versions not specified Description: The issue is related to insufficient input validation. It may allow a remote attacker to gain unauthorized access to protected information. Recommendations: At the moment, there...

CVE-2020-9205

There has a CSV injection vulnerability in ManageOne 8.0.1. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to...

PT-2021-1979 · Cisco · Cisco Small Business Rv082 +5

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 affected versions not specified Description: The issue is related to insufficient validation of user-supplied input in the web-based management interface of the affected...

PT-2021-1920 · Cisco · Cisco Webex Meetings Server +1

Name of the Vulnerable Software and Affected Versions: Cisco Webex Meetings and Cisco Webex Meetings Server Software affected versions not specified Description: A vulnerability in the user interface could allow an authenticated, remote attacker to inject a hyperlink into a meeting invitation ema...

PT-2021-1934 · Cisco · Cisco Small Business Rv260W +4

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers affected versions not specified Description: The web-based management interface of the affected devices has multiple vulnerabilities due to insufficient input validatio...

The vulnerability of the InnoDB component of the MySQL Database Server allows a hacker to gain access to data for reading or to gain privileged access to the infrastructure.

The vulnerability of the InnoDB component in the MySQL Database Management System exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain read access to data or gain privileged access to the infrastructure...

The vulnerability of the Oracle CRM Technical Foundation component of the Oracle E-Business Suite system, which allows a perpetrator to gain unauthorized access to protected information or to modify, add, or delete data.

The vulnerability of the Oracle CRM Technical Foundation component of the Oracle E-Business Suite exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information or to modify, add,...

CentOS 8 : systemd (CESA-2019:0990)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:0990 advisory. - systemd: Insufficient input validation in busprocessobject resulting in PID 1 crash CVE-2019-6454 Note that Nessus has not tested for this issue but has inste...

Security Advisory - CSV Injection Vulnerability in ManageOne Product

There has a CSV injection vulnerability in ManageOne Product. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files ...

Kaspersky TinyCheck Command Injection Vulnerability

Kaspersky TinyCheck is a software from the Russian company Kaspersky that captures network communications from smartphones or any device that can be associated with a Wi-Fi access point. TinyCheck before commits 9fd360d and ea53de8 suffers from a command injection vulnerability that stems from...

Nagios XI autodiscovery_component Command Injection (CVE-2020-28648)

A command injection vulnerability exists in Nagios XI. The vulnerability is due to insufficient input validation of the requests submitted to the Auto-Discovery endpoint...