FusionPBX Path Traversal Vulnerability (CNVD-2021-36593)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. FusionPBX 4.5.7 suffers from a path traversal vulnerability that allows remote malicious...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2021-36591)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A security vulnerability exists in FusionPBX 4.5.7, which allows remote malicious users to...

CVE-2020-35580

A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the contents of the SearchBl...

Design/Logic Flaw

The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls...

UBUNTU-CVE-2021-32056

Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall...

Security Vulnerabilities fixed in Thunderbird 78.10.1 — Mozilla

The Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating if an attacker spammed the 'Stop' command; but also exposed atta...

Security Vulnerabilities fixed in Firefox ESR 78.10.1 — Mozilla

The Mozilla Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating if an attacker spammed the 'Stop' command; but also...

Mozilla Thunderbird < 78.10.1

"The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 78.10.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-19 advisory. - The Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal...

Mozilla Thunderbird < 78.10.1

"The version of Thunderbird installed on the remote Windows host is prior to 78.10.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-19 advisory. - The Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal remote...

Mozilla Firefox ESR < 78.10.1

"The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 78.10.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-18 advisory. - The Mozilla Maintenance Service granted SERVICESTART access to BUILTIN|Users which, in a domain network, grant...

CVE-2021-30496

The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service application crash if the victim pastes an attacker-supplied message e.g., in the Persian language into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that...

MediaWiki 信息泄露漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. MediaWiki suffers from an information disclosure vulnerability that results from the program...

CVE-2021-21433: Improper Control of Generation of Code

Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote users to execute commands on the server resulting in serious issues. This flaw is patched in 0.0.2...

Zero-Day Bug Impacts Problem-Plagued Cisco SOHO Routers

Cisco Systems said it will not fix a critical vulnerability found in three of its SOHO router models. The bug, rated 9.8 in severity out of 10, could allow unauthenticated remote users to hijack targeted equipment and gain elevated privileges within effected systems. The three Cisco router models...

Oracle MySQL Server <= 5.1.62 / 5.4.x <= 5.5.22 Security Update (cpujul2012) - Windows

Oracle MySQL Server is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:mysql"; if...

Cross site request forgery (csrf)

Wavlink WN575A4 and WN579X3 devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request...

CVE-2020-13117

Vulnerability summary (CVE-2020-13117) : Wavlink WN575A4 and WN579X3 devices (and WN530G3A per CVE scope) are affected by an unauthenticated remote command-injection vulnerability in the login API that uses the key parameter. The connected nuclei template confirms remote command execution, tested...

CVE-2020-24666

The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Display Name' parameter. Remediated in = 9.1.0.1...

CVE-2020-24670

The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'type' attribute of 'dashboardXml' parameter...

Cross site scripting

The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'pho:title' attribute of 'dashboardXml' parameter...