629 matches found
CVE-2021-21978
CVE-2021-21978 CVE-2021-21978 EXP VMware View Planner RCE CVE-2021-21978 Shell inversé...
CVE-2021-21978
CVE-2021-21978 CVE-2021-21978 RCE exp الإصدارات المتأثرة VMware View Planner Harness 4.X على غرار CVE-2021-21978، تسمح هذه الثغرة بتحميل أي ملف دون تفويض، وتحقيق تنفيذ تعليمات برمجية عن بعد عن طريق تعديل برنامج py النصي المرفق. جدير بالذكر أن تنفيذ الأوامر يتم داخل حاوية docker، وليس مباشرة في...
CVE-2019-13027
CVE-2019-13027 تفاصيل الكشف عن CVE-2019-13027 الجدول الزمني للتواصل مع البائع: 1 يوليو 2019 - لا رد، لا بريد إلكتروني. 4 يوليو 2019 - لا رد، لا بريد إلكتروني. 8 يوليو 2019 - تم إرسال البريد الإلكتروني، وتم إنشاء مستودع Github. 11 يوليو 2019 - لا استجابة من البائع. تم الكشف عن الثغرة. نوع الثغرة ح...
CVE-2021-21978
CVE-2021-21978 البرنامج النصي للاستغلال مع إظهار النتائج، بطريقة أبسط 0. معلومات الثغرة توجد في واجهة إدارة الويب الخاصة بـ VMware View Planner نقطة دخول لرفع ملف وظيفة السجل، دون الحاجة إلى مصادقة، ومسار ملف السجل المكتوب قابل للتحكم من قبل المستخدم. من خلال الكتابة فوق ملف وظيفة رفع السجل...
Linux Distros Unpatched Vulnerability : CVE-2026-18699
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by...
CVE-2026-54509
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...
CVE-2026-62945 TREK: Cross-trip reservation title disclosure via file links
TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...
CVE-2026-54509 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...
CVE-2026-53472
A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...
CVE-2026-53472
The CVE-2026-53472 issue affects the migration-planner component. Root cause: insufficient validation of AgentStatusUpdate.CredentialUrl allows an authenticated attacker to store a javascript: URL, which a victim can render in the Hybrid Cloud Console to trigger Cross-Site Scripting (XSS). Impact...
CVE-2026-53472 Migration-planner: credentialurl validator accepts javascript: urls
A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...
CVE-2026-53472
A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...
EUVD-2026-58664
A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...
CVE-2026-53472 Migration-planner: credentialurl validator accepts javascript: urls
A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...
CVE-2026-18699
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...
CVE-2026-18699
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...
UBUNTU-CVE-2026-18699
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...
CVE-2026-18699 Improper Input Validation in MongoDB Query Planner Leads to Denial of Service
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...
CVE-2026-18699
Technical details about CVE-2026-18699 are not publicly available in the provided documents. Monitor for updates from official advisories.
EUVD-2026-56880
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...