PT-2021-24430

Name of the Vulnerable Software and Affected Versions: node-export-server versions prior to 2.1.0 Description: The issue allows for reading and outputting files served by other services on the internal network. This potentially enables a malicious user to gain read access to internal web resource...

Unspecified Vulnerability in Mozilla Firefox (CNVD-2021-15047)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in versions of Mozilla Firefox prior to 85. An attacker could gain access to hosts on an internal network as well as services running on a user's local computer...

Blind SSRF in widgetConnector - CVE-2021-26072

Affected versions of Atlassian Confluence Server allow remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery SSRF vulnerability in the widgetconnector plugin. When running in an environment like Amazon EC2, this flaw may be used to access...

CVE-2021-23961

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox 85...

CVE-2021-23961

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox 85...

Design/Logic Flaw

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox 85...

CVE-2021-23961

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox 85...

CVE-2021-23961

CVE-2021-23961 is an information-disclosure vulnerability affecting Mozilla Firefox prior to 85, with related entries in Thunderbird. The connected advisories describe that a malicious webpage leveraging slipstream techniques could expose internal network hosts and services on the client’s machin...

CVE-2021-23961

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox 85...

CVE-2021-23961

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox 85...

CVE-2021-23961: Undefined Security Weakness

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox 85...

QIWI: Remote Code Execution on contactws.contact-sys.com via SQL injection in TAktifBankObject.GetOrder in parameter DOC_ID

Summary The API interface on https://contactws.contact-sys.com:3456/ accepts a body to interact with the server's AppServ object. Because of insufficient input validation, an attacker can abuse the DOCID parameter on the TAktifBankObject operation GetOrder to inject arbitrary SQL statements into...

CVE-2020-13461

Username enumeration in present in Tufin SecureTrack. It's affecting all versions of SecureTrack. The vendor has decided not to fix this vulnerability. Vendor's response: "This attack requires access to the internal network. If an attacker is part of the internal network, they do not require acce...

CVE-2020-13461

CVE-2020-13461 applies to Tufin SecureTrack and concerns username enumeration affecting all versions. The available documents state that this vulnerability allows an attacker to enumerate usernames and that the vendor has decided not to fix it. The vendor’s response notes that the attack requires...

PT-2021-9616

Name of the Vulnerable Software and Affected Versions Tufin SecureTrack affected versions not specified Description The issue is related to username enumeration. The vendor has stated that this attack requires access to the internal network and that an attacker with internal network access would...

CVE-2020-13461: Undefined Security Weakness

Username enumeration in present in Tufin SecureTrack. It's affecting all versions of SecureTrack. The vendor has decided not to fix this vulnerability. Vendor's response: "This attack requires access to the internal network. If an attacker is part of the internal network, they do not require acce...

CarrierWave Code Issue Vulnerability

Mshibuya CarrierWave is an upload tool from the Mshibuya Personal Organization in the United States. It provides a simple and extremely flexible way to upload files from Ruby applications. A code issue vulnerability exists in CarrierWave versions prior to 1.3.2 and 2.1.1 that stems from a...

SAP BusinessObjects Business Intelligence Platform SSRF Vulnerability (direct check)

Binary data sapbusinessobjectsintelligenceplatformcve-2020-6308.nbin...

Remote Attackers Can Now Reach Protected Network Devices via NAT Slipstreaming

Disconnecting devices from the internet is no longer a solid plan for protecting them from remote attackers. A new version of a known network-address translation NAT slipstreaming attack has been uncovered, which would allow remote attackers to reach multiple internal network devices, even if tho...

Information Disclosure

firefox is vulnerable to information disclosure. The vulnerability exists by combining the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine...