PT-2023-18787 · Splunk · Splunk Cloudconnect Sdk +1

Name of the Vulnerable Software and Affected Versions: Splunk Add-on Builder versions prior to 4.1.2 Splunk CloudConnect SDK versions prior to 3.1.3 Description: The issue occurs when requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after...

GSS-NTLMSSP 缓冲区错误漏洞

GSS-NTLMSSP is gssapi open source mechglue plugin that implements the NTLM authentication GSSAPI library . GSS-NTLMSSP version 1.2.0 before the buffer error vulnerability , the vulnerability stems from the application allows a length greater than 4GB of the token , an attacker can use the...

CVE-2023-0669

Fortra formerly, HelpSystems GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2...

Couchbase Server 安全漏洞

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server versions prior to 6.6.6, 7.x through 7.0.5, and 7.1.x through 7.1....

CVE-2022-34335

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.1 could allow an authenticated user to exhaust server resources which could lead to a denial of service. IBM X-Force ID: 229705...

PortlandLabs Concrete CMS 授权问题漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A security vulnerability exists in Concrete CMS concrete5 versions prior to 8.5.10 and versions 9.0.0 through 9.1.2, which stems from a new session ID not being issued...

PT-2022-27002 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS formerly concrete5 versions 9.0.0 through 9.1.2 Concrete CMS formerly concrete5 versions prior to 8.5.10 Description: The issue allows the authTypeConcreteCookieMap table to be filled up, causing a denial of service due to high...

Varnish Cache 环境问题漏洞

Varnish Cache is a set of reverse web caching servers. An environment issue vulnerability exists in Varnish Cache version 7.x up to and including version 7.1.2, and version 7.2.x up to and including version 7.2.1. An attacker exploits this vulnerability to bypass host routing requests in the VCL...

PT-2022-5635 · Microsoft · Sql Server +3

Name of the Vulnerable Software and Affected Versions: .NET Framework versions prior to the November 2022 update System.Data.SqlClient versions prior to 4.8.5 Microsoft.Data.SqlClient versions prior to 2.1.2 Description: A vulnerability in .NET Framework allows attackers to obtain sensitive...

CVE-2021-46849

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29421. Reason: This candidate is a duplicate of CVE-2021-29421. Notes: All CVE users should reference CVE-2021-29421 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...

AZL-44613 CVE-2022-32149 affecting package podman for versions less than 5.6.1-2

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...

Siemens RUGGEDCOM 输入验证错误漏洞

Siemens RUGGEDCOM is a communication device from Siemens, Germany. It provides fast and reliable communications for power, transportation, oil and gas, and other industries. An input validation error vulnerability exists in Siemens RUGGEDCOM, which stems from an inability to properly handle packe...

OpenHarmony 授权问题漏洞

OpenHarmony is a kind of Hongmeng operating system open source project of China OpenAtom Foundation Foundation. An authorization issue vulnerability exists in OpenHarmony-v3.1.2 and earlier versions, which can be exploited by local attackers to bypass privilege control and obtain sensitive...

TOTOLINK A860R 安全漏洞

The TOTOLINK A860R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK A860R version V4.1.2cu.5182B20201027, which originates from an unfiltered parameter in infostat.cgi, resulting in a buffer overflow...

CVE-2022-39843

123elf Lotus 1-2-3 before 1.0.0rc3 for Linux, and Lotus 1-2-3 R3 for UNIX and other platforms through 9.8.2, allow attackers to execute arbitrary code via a crafted worksheet. This occurs because of a stack-based buffer overflow in the cell format processing routines, as demonstrated by a certain...

Dell Container Storage Modules 操作系统命令注入漏洞

Dell Container Storage Modules is a set of modules from Dell USA. Dell Container Storage Modules version 1.2 contains an operating system command injection vulnerability, which stems from a failure to properly filter constructed command special characters, commands, etc. in the goiscsi and gobric...

TOTOLINK A800R 信任管理问题漏洞

The TOTOLINK A800R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK A800R version V4.1.2cu.5137B20200730, which originates from the inclusion of a hardcoded password for root in /etc/shadow.sample...

GHSA-6278-2Q4M-CMF3 ZK Framework vulnerable to malicious POST

ZK Framework version 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader...

TOTOLINK A3700R 缓冲区错误漏洞

The TOTOLINK A3700R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK A3700R version V9.1.2u.6134B20201202, which stems from a stack overflow in the command parameter of the setTracerouteCfg method...

PT-2022-17373 · WordPress · Team Wordpress

Name of the Vulnerable Software and Affected Versions: The Team WordPress plugin versions prior to 4.1.2 Description: The issue allows any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is...