CVE-2021-33213

An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address...

Elements-IT HTTP Commander 代码问题漏洞

Elements-IT HTTP Commander is a server-hosted, web-based file management solution from Elements-IT Germany. It provides basic functionality for working with files creating, copying, deleting, etc. and many other additional features, such as integration with cloud services, online editing of Offic...

CVE-2021-36124

An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as SQL injection...

CVE-2021-36124

An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as SQL injection...

CVE-2021-34332

A vulnerability has been identified in JT2Go All versions V13.2, Teamcenter Visualization All versions V13.2. The BMPLoader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in an infinite loop condition...

The vulnerability of the sscanf() function in the libcurl library, a software tool for interacting with servers via CURL, allows an attacker to gain unauthorized access to protected information.

The vulnerability of the sscanf function in the libcurl library, a software tool for interacting with servers via CURL, is related to the use of uninitialized resources. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

ShareCare SQL注入漏洞

ShareCare is a clinical and financial software system from Echo Group. An SQL injection vulnerability exists in Echo ShareCare version 8.15.5 that stems from not performing authentication or authorization checks when accessing a subset of sensitive resources, which could allow an unauthenticated...

jetty: Ambiguous paths can access WEB-INF

In Jetty the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can use this vulnerability to reveal sensitive information regarding the implementation of a web application...

Stormshield SES Evolution 安全漏洞

Stormshield SES Evolution is a security solution from the French company Stormshield. A security vulnerability existed prior to SES Evolution 2.1.0, which allowed the deletion of some resources not currently used by any security policy by exploiting access to a computer with the management consol...

Xxe

It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used...

XML-Atom 代码问题漏洞

XML-Atom is an XML-based format for Atom that is used to describe Atom feeds and the information items within them, as well as a protocol for publishing and editing Atom feeds. A code issue vulnerability exists in XML-Atom Perl prior to 0.39, which allows an attacker to exploit the vulnerability ...

Top 10 Cloud security tips

About half of the pen tests we’re asked to do involved cloud services at some point. We’ve even tested a cloud platform on an aeroplane – the irony was not lost on us! There is a multitude of ways to improve the security of your cloud platforms and often those ways are ever-changing or obscured...

CVE-2021-20474

IBM Guardium Data Encryption GDE 3.0.0.2 and 4.0.0.4 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources...

The vulnerability of the Intel Virtualization Technology for Directed I/O (VT-d) implementation arises due to incomplete cleanup of temporary or auxiliary resources, allowing attackers to exploit their privileges.

The vulnerability of the Intel Virtualization Technology for Directed I/O VT-d implementation exists due to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow attackers to enhance their privileges...

Resource Exhaustion in Spring Security

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker c...

Beware password-spraying fancy bears

The NSA, FBI, and CISA, in cooperation with the UKs National Cyber Security Centre NCSC, have issued a report that describes in detail why, and how, they think that a Russian military unit is behind large-scale brute-force attacks on the cloud-IT resources of government and private sector compani...

SQL Injection Vulnerability in Chengdu Zero Takeoff Network Customer Management CRM System (CNVD-2021-50629)

Customer management CRM system is zero takeoff network development, based on the GPLv3 protocol release, for small and medium-sized management activities, to provide customer relationship management CRM, sales and marketing inventory JXC, human resources HRM, logistics office supplies, fixed...

Ec-cube 访问控制错误漏洞

Ec-cube is an open source e-commerce system from the Japanese company Ec-cube. An Access Control Error vulnerability exists in EC-CUBE that stems from the failure to properly restrict access to resources from unauthorized roles. An attacker could exploit this vulnerability to bypass access...

SQL Injection Vulnerability in Chengdu Zero Takeoff Network Customer Management CRM System

Customer management CRM system is zero takeoff network development, based on the GPLv3 protocol release, for small and medium-sized management activities, to provide customer relationship management CRM, sales and marketing inventory JXC, human resources HRM, logistics office supplies, fixed...

VMware Spring Security 安全漏洞

VMware Spring Security is a suite of security frameworks from VMware that provide illustrative security protections for Spring-based applications. A security vulnerability exists in Spring Security that allows an attacker to send multiple requests to initiate authorization requests granted by the...