CVE-2021-38516

Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D7000v2 before 1.0.0.52, D7800 before 1.0.1.44, D8500 before 1.0.3.43, DC112A before 1.0.0.40, DGN2200v4 before 1.0.0.108, RBK50 before 2.3.0.32, RBR50...

多款Netgear产品安全漏洞

The Netgear NETGEAR D6400 and NETGEAR D6220 are both wireless modems from Netgear, Inc. A security vulnerability exists in NETGEAR that stems from certain NETGEAR devices being affected due to a lack of access control at the functional level...

CVE-2021-35047

Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is present in Fidelis Network and...

Dell Hybrid Client Access Control Error Vulnerability

DELL Dell Hybrid Client is an application from Dell, Inc. An access control error vulnerability exists in versions prior to Dell Hybrid Client 1.5, which could be exploited by an attacker to gain root-level access to the system...

The vulnerability in the architecture of Apple M1 chips, related to the open access from the EL0 mode of the ARM architecture registers under the code s3_5_c15_c10_1, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Apple M1 chip’s architecture is related to the open access from the EL0 mode of the ARM architecture registers, under the code s35c15c101. Exploiting this vulnerability can allow a perpetrator to gain unauthorized access to protected information...

PT-2021-14585

Name of the Vulnerable Software and Affected Versions Dell Hybrid Client versions prior to 1.5 Description The issue is related to a missing authentication for a critical function, allowing a local unauthenticated attacker to gain root level access to the system. Recommendations For versions prio...

CVE-2021-21535: Missing Authentication for Critical Function

Dell Hybrid Client versions prior to 1.5 contain a missing authentication for a critical function vulnerability. A local unauthenticated attacker may exploit this vulnerability in order to gain root level access to the system...

PT-2021-15752

Name of the Vulnerable Software and Affected Versions: WP Page Builder versions prior to 1.2.4 Description: The issue allows subscriber-level users to edit and make changes to any and all posts and pages by default, unless user roles are specifically blocked from editing posts and pages...

Rockstar Games: Password and mail address stored unencrypted in memory - Rockstar Game Launcher

User credentials were stored unencrypted in memory for a short time during the login process for a game launcher application. The credentials could have been retrieved by dumping application memory after login. This issue has since been resolved to no longer expose passwords in memory...

VulnCheck KEV: CVE-2020-26919

NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level...

Microsoft Exchange Server 代码问题漏洞

Exchange is a messaging and collaboration system that is a suite of e-mail service components from Microsoft. Microsoft Exchange Server deserialization vulnerability, which requires administrator privileges, can be exploited by an attacker to be able to run code as SYSTEM on Exchange Server...

Cisco Application Services Engine 访问控制错误漏洞

Cisco Application Services Engine provides a common platform for deploying Cisco data center applications. An unauthorized access vulnerability exists in Cisco Application Services Engine 1.13d and earlier versions, which can be exploited by a remote, unauthenticated attacker to elevate access to...

CVE-2020-13409

Tufin SecureTrack R20-2 GA contains reflected + stored XSS as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users. Both stored, and reflected payloads are triggerable by admin, so...

CVE-2020-13409

Tufin SecureTrack R20-2 GA contains reflected + stored XSS as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users. Both stored, and reflected payloads are triggerable by admin, so...

PT-2021-9603

Name of the Vulnerable Software and Affected Versions Tufin SecureTrack versions prior to R20-2 GA Description The issue concerns reflected and stored XSS, where the value is not only reflected back to the user but also stored within the database. This stored payload can be triggered again by the...

CVE-2021-26915

NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in webrepdb StatusServlet...

NCR Command Center Agent Remote Code Execution

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. The...

CVE-2021-25243

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain patch level information...

Debian: Security Advisory (DLA-2536-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Projectnotes Student Result Management System SQL Injection Vulnerability

Projectnotes Student Result Management System is a Php-based student result management system organized by Projectnotes. Projectnotes Student Result Management System suffers from a SQL injection vulnerability that can be exploited by an attacker to access the admin panel and manage results per...