2471 matches found
CVE-2021-37861
Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails...
CVE-2021-40281
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dlprint.php when registering ordinary users...
CVE-2021-39000
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force ID: 213215...
Dell Emc CloudLink 输入验证错误漏洞
Dell EMC CloudLink is a flexible data encryption and key management solution for data encryption in public, private, and hybrid cloud environments.Dell EMC CloudLink 7.1 and earlier versions are vulnerable to an input validation error that could be exploited by a remote, low privilege attacker to...
WordPress SQL注入漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin SEO Redirection prior to version 8.2. T...
Unlimited Sitemap Generator vulnerable to cross-site request forgery
Overview Unlimited Sitemap Generator provided by XML-Sitemaps contains a cross-site request forgery vulnerability CWE-352. Kanta Nishitani of Ierae Security, Inc reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impa...
XXE vulnerability in performance
performance 3.20 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted XML report file that uses external entities for extraction of secrets from the Jenkins controller or...
Connext Dds 多款产品缓冲区错误漏洞
Real-Time Innovations Connext Dds Professional and Connext Dds Secure are both products of Real-Time Innovations, Inc. Connext Dds Professional is a software framework designed to meet the demanding connectivity requirements of autonomous systems. Connext Dds Secure is a trusted software...
Intel Ethernet controllers 安全漏洞
Intel Ethernet Controllers is an Ethernet controller from Intel Corporation USA. A security vulnerability exists in Intel Ethernet controllers, which stems from an out-of-bounds write in the IntelR Ethernet 700 firmware to a series of controllers prior to version 8.2 that could allow a privileged...
CVE-2021-35571
Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft component: Advising Notes. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...
CVE-2021-35571
Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft component: Advising Notes. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...
CVE-2021-38389
Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code...
IBM Cognos Analytics 代码注入漏洞
A remote code execution vulnerability exists in IBM Cognos Analytics version 11.1.7, 11.2.0, a suite of business intelligence software from IBM Corporation that provides valuable information, secure data governance, and reporting. The vulnerability stems from incorrect neutralization of...
CVE-2021-22963
A redirect vulnerability in the fastify-static module version 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: tru...
Gila CMS Cross-Site Scripting Vulnerability (CNVD-2021-84281)
Gila CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in Gila CMS version 2.2.0, which can be used by an attacker to steal cookies, passwords, or run arbitrary code on a victim's browser...
CVE-2021-29700
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authneticated attacker to obtain sensitive information from configuration files that could aid in further attacks against the system. IBM X-Force ID: 200656...
CVE-2021-39486
A Stored XSS via Malicious File Upload exists in Gila CMS version 2.2.0. An attacker can use this to steal cookies, passwords or to run arbitrary code on a victim's browser...
PT-2021-22723 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 12.2 and later Description: A vulnerability was discovered that allows an attacker to cause uncontrolled resource consumption with a specially crafted file. Recommendations: For GitLab versions 12.2 and later, at the moment,...
Cloudron 跨站脚本漏洞
Cloudron is a platform from Cloudron, Inc. for installing, managing, and securing web applications on servers. A security vulnerability exists in Cloudron 6.2 that stems from insufficient validation of the returnTo parameter input on the login page...