CVE-2021-28349

Windows GDI+ Remote Code Execution Vulnerability...

CVE-2021-28348

Windows GDI+ Remote Code Execution Vulnerability...

Microsoft Windows GDI+ 代码注入漏洞

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. A remote code execution vulnerability exists in GDI in Microsoft Windows and Windows Server, which can be...

Microsoft Windows GDI+ 代码注入漏洞

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. A remote code execution vulnerability exists in GDI+ in Microsoft Windows and Windows...

JTEKT TOYOPUC-Plus 安全漏洞

JTEKT TOYOPUC-Plus is a PLC from JTEKT Japan. A security vulnerability exists in several TOYOPUC products. The vulnerability stems from the inability to establish Ethernet communication with other devices when the product's Ethernet communication is in the open state, depending on the settings of...

PT-2021-2681 · Microsoft · Windows Gdi +1

Name of the Vulnerable Software and Affected Versions: Windows GDI+ affected versions not specified Description: The issue exists due to insufficient input validation in the Windows Graphics Device Interface Plus GDI+ component of Windows operating systems. This can allow an attacker to gain...

PT-2021-2661 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to incorrect code generation management in the GDI+ component of Microsoft Windows operating systems. This allows a remote attacker to execute arbitrary code on the...

The vulnerability of NETGEAR ProSafe Plus JGS516PE microcontroller-based software, related to the lack of protection for service data, allows a intruder to trigger a service failure.

The vulnerability of NETGEAR ProSafe Plus JGS516PE microcontroller-based devices lies in the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

PT-2021-2719 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to incorrect code generation management in the GDI+ component of Microsoft Windows operating systems. It allows remote attackers to execute arbitrary code using a...

ManageEngine ServiceDesk Plus < 11.2 Build 11200 Unauthenticated Stored XSS

A stored cross-site scripting XSS vulnerability exists in the XML processing logic of asset discovery. By sending a crafted HTTP POST request to /discoveryServlet/WsDiscoveryServlet, a remote, unauthenticated attacker can create an asset containing malicious JavaScript. When an administrator view...

CVE-2021-20080

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting XSS attacks by uploading a crafted XML asset file...

CVE-2021-20080

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting XSS attacks by uploading a crafted XML asset file...

Cross site scripting

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting XSS attacks by uploading a crafted XML asset file...

CVE-2021-20080

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting XSS attacks by uploading a crafted XML asset file...

CVE-2021-20080

CVE-2021-20080 affects Zoho ManageEngine ServiceDesk Plus (before 11200) and AssetExplorer (before 6800). Root cause: insufficient output sanitization during XML asset processing. Impact: remote, unauthenticated attacker can trigger stored XSS by uploading a crafted XML asset file; XSS persists w...

CVE-2021-20080

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting XSS attacks by uploading a crafted XML asset file...

ZOHO ManageEngine ServiceDesk Plus 跨站脚本漏洞

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates Incident Management, Problem Management, Asset Management, IT Project Management, Procurement and Contract Management and other functional modules. A cross-site scripti...

CVE-2021-24175

The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user including admin by just providing the related username, as well as create accounts with...

CVE-2021-24175 The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user including admin by just providing the related username, as well as create accounts with...

PT-2021-15721

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder WordPress plugin versions prior to 4.1.7 Description: The issue allows malicious actors to bypass authentication, enabling unauthenticated users to log in as any user, including admin, by providing t...