PT-2021-4633 · NetGear · Netgear R6700 +29

Name of the Vulnerable Software and Affected Versions: NETGEAR R6400 versions R6400 through R6400v2 NETGEAR R6700 versions R6700v3 NETGEAR R6900P NETGEAR R7000 versions R7000 through R7000P NETGEAR R7850 NETGEAR R7900P NETGEAR R7960P NETGEAR R8000 versions R8000 through R8000P NETGEAR RAX15 NETGE...

NETGEAR R7000 授权问题漏洞

Netgear NETGEAR R7000 is a wireless router from Netgear, Inc. An authorization issue vulnerability exists in the NETGEAR R7000 Router, which stems from a lack of valid authentication when the product handles soap requests to reset passwords. An attacker could reset the password through this...

CVE-2021-34861

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the webproc endpoint, which listens on TCP port 80 by defaul...

CVE-2021-34863

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:page parameter provided to the webpr...

PT-2021-23092 · Unknown +1 · Freeswitch +1

Name of the Vulnerable Software and Affected Versions: FreeSWITCH versions prior to 1.10.7 Description: The issue allows remote attackers to terminate calls by flooding a media port handling SRTP traffic with specially crafted SRTP packets, leading to denial of service. This can be done...

PT-2021-6150 · Tp Link · Tp-Link Tl-Wr940N

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR940N version 3.20.1 Build 200316 Rel.34392n 5553 Description: The issue results from the lack of proper access control within the httpd service, which listens on TCP port 80 by default. This allows network-adjacent attackers to...

CVE-2021-35979

An issue was discovered in Digi RealPort through 4.8.488.0. The 'encrypted' mode is vulnerable to man-in-the-middle attacks and does not perform authentication...

PT-2021-5577

Name of the Vulnerable Software and Affected Versions Sitecore XP versions 7.5 Initial Release through 8.2 Update-7 Description The issue is related to an insecure deserialization attack that can lead to remote command execution on the machine. No authentication or special configuration is requir...

PT-2021-23103 · Sylius · Syliud Paypal Plugin

Name of the Vulnerable Software and Affected Versions: Sylius/PayPalPlugin versions prior to 1.2.4 Sylius/PayPalPlugin versions prior to 1.3.1 Description: The URL to the payment page done after checkout was created with an autoincremented payment id /pay-with-paypal/id and therefore it was easy ...

Exploit for Race Condition in Openbsd Openssh

PoC exploit for CVE-2018-15473, a vulnerability in the Apache St...

CVE-2021-35976

The CVE-2021-35976 vulnerability affects Plesk Obsidian on Linux, specifically versions 18.0.0 through 18.0.32. It is a reflected XSS in the site preview feature accessed via the /plesk-site-preview/ path. An attacker can cause JavaScript execution in a victim’s browser by sending a link that pre...

CVE-2021-30948

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 15.2 and iPadOS 15.2. A person with physical access to an iOS device may be able to access stored passwords without authentication...

PT-2021-20708 · D Link · D-Link Dap-2020

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2020 version 1.01rc001 Description: This issue allows network-adjacent attackers to disclose sensitive information on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the...

Motorola MM1000 授权问题漏洞

The Motorola MM1000 is a network adapter from Motorola, USA. A security vulnerability exists in the Motorola MM1000 that originates from an attacker being able to access the Motorola MM1000 device configuration portal and modify adapter settings without authentication...

CVE-2021-35936 No Authentication on Logging Server

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

Hospital Management System 安全漏洞

PHPGurukul Hospital Management System is a PHP and MySQL based hospital management system. a security vulnerability exists in PHPGurukul Hospital Management System, which originates from admin-panel1.php in the software, which can delete unauthenticated authenticated physician entries. No details...

Siemens Nucleus Improper Input Validation

A vulnerability has been identified in APOGEE MEC/MBC/PXC P2 All versions = V3.0, APOGEE PXC Series P2 All versions = V2.8.2, Desigo PXC Power PC All versions = V2.3x and = V2.3x and = V3.0, VSTAR All versions. By sending specially crafted DHCP packets to a device where the DHCP client is enabled...

Atlassian Jira 访问控制错误漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira that could be exploited by a remote attacker to log in to a user account knowi...

CVE-2021-35464

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

CVE-2020-23284

Information disclosure in aspx pages in MV's IDCE application v1.0 allows an attacker to copy and paste aspx pages in the end of the URL application that connect into the database which reveals internal and sensitive information without logging into the web application...