CVE-2021-33829

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

CVE-2021-33829

A cross-site scripting XSS vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! is mishandled...

CVE-2021-33841

CVE-2021-33841 applies to the Circutor SGE-PLC1000 device running firmware version 0.9.2b. The vulnerability is an OS command injection caused by the device’s firmware not handling some requests correctly, enabling a remote attacker to inject code into the operating system with maximum privileges...

Security Bulletin: IBM DataPower Gateway affected by multiple vulnerabilities in Dojo

Summary IBM has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values, an attacker could exploit this vulnerability to...

CVE-2021-33841

SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating system with maximum privileges...

Code injection

MobaXterm before 21.0 allows remote servers to cause a denial of service Windows GUI hang via tab title change requests that are sent repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls...

CVE-2021-28807

A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center...

CVE-2021-28807: Improper Neutralization of Input During Web Page Generation

A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center...

PT-2021-17931

Name of the Vulnerable Software and Affected Versions: QNAP NAS running Q’center versions prior to Q’center v1.10.1004 QNAP NAS running Q’center versions prior to Q’center v1.12.1012 Description: A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running...

CVE-2020-4520

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the code. IBM X-Force ID: 182395...

Code injection

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following t...

CVE-2020-21054

Cross Site Scripting XSS vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "f" variable in app\vars\varstextarea.php...

CVE-2020-21053

FusionPBX 4.5.7 contains a Cross-Site Scripting (XSS) vulnerability in app\devices\device_imports.php via an unsanitized query_string variable. Several connected sources confirm the issue, describing that remote attackers can inject arbitrary web script or HTML through this parameter, leading to ...

Microsoft OLE Automation Remote code 代码注入漏洞

Microsoft OLE Automation Remote code is a software application from Microsoft Corporation USA. An automation software. A code injection vulnerability exists in Windows OLE. The following products and editions are affected: Windows Server 2008 for x64-based Systems Service Pack 2 Server Core...

Security Bulletin: Vulnerability in WebSphere Application Server Liberty affects IBM Financial Transaction Manager for Interac e-Transfers for Red Hat OpenShift (CVE-2020-5258)

Summary Dojo vulnerability in WebSphere Application Server Liberty affects IBM Financial Transaction Manager Interac e-Transfers for RedHat OpenShift. Vulnerability Details CVEID: CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by ...

uClibc-ng Input Validation Error Vulnerability

uclibc-ng is an application. Small C library for Linux. An input validation error vulnerability exists in versions prior to uClibc-ng 1.0.37, which stems from being susceptible to integer wrapping by the malloc-simple function. This incorrect memory allocation could lead to arbitrary memory...

NXP MCUXpresso Software Development Kit Input Validation Error Vulnerability

The NXP MCUXpresso Software Development Kit is an application system from the Dutch company NXP. It is used to simplify and accelerate the development of applications with ARM's Cortex NXP-M based devices, including general purpose, crossover and Bluetooth microcontrollers. An input validation...

CISA Releases ICS Advisory on Real-Time Operating System Vulnerabilities

CISA has released Industrial Control Systems Advisory ICSA-21-119-04 Multiple RTOS to provide notice of multiple vulnerabilities found in real-time operating systems RTOS and supporting libraries. Successful exploitation of these vulnerabilities could result in unexpected behavior such as a crash...

IBM Spectrum Scale 代码代码注入漏洞

IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...

CVE-2021-3012

The CVE-2021-3012 entry concerns a cross-site scripting (XSS) vulnerability in Esri ArcGIS Enterprise/Server prior to version 10.9. The flaw arises in the Document Link of documents, where remote authenticated users can inject arbitrary JavaScript by exploiting a malicious HTML attribute (e.g., o...