CVE-2019-15059

Summary: CVE-2019-15059 affects Liberty lisPBX 2.0-4. Remote backups (/backup/lispbx-CONF-YYYY-MM-DD.tar, /backup/lispbx-CDR-YYYY-MM-DD.tar) can be retrieved without authentication, exposing PBX data including extension numbers, contacts, and passwords. Impact (as stated): Unauthorized access to ...

VulnCheck KEV: CVE-2019-14205

A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST'adaptive-images-settings''sourcefile' parameter in adaptive-images-script.php...

Wyse Management Suite Denial of Service Vulnerability

Wyse Management Suite is a next-generation management solution that enables you to centrally configure, monitor, manage and optimize Wyse thin clients. A denial of service vulnerability exists in Wyse Management Suite versions prior to 3.2. An attacker could exploit this vulnerability to cause a...

Denial Of Service (DoS)

cxf-rt-rs-security-oauth2 is vulnerable to denial of service DoS. The vulnerability exists as it does not properly validate the requesturi parameter, allowing a REST request to the parameter in the request to retrieve a token...

Mini Mouse 9.2.0 - Path Traversal

Exploit Title: Mini Mouse 9.2.0 - Path Traversal Author: gosh Date: 02-04-2021 Vendor Homepage: http://yodinfo.com Software Link: https://imgv.oss-cn-hangzhou.aliyuncs.com/minimouse.msi Version: 9.2.0 Tested on: Windows 10 Pro build 19042.662 POC GET /file=C:%5CWindows%5Cwin.ini HTTP/1.1 Host:...

CVE-2021-21533

Wyse Management Suite versions up to 3.2 contains a vulnerability wherein a malicious authenticated user can cause a denial of service in the job status retrieval page, also affecting other users that would have normally access to the same subset of job details...

Design/Logic Flaw

Wyse Management Suite versions up to 3.2 contains a vulnerability wherein a malicious authenticated user can cause a denial of service in the job status retrieval page, also affecting other users that would have normally access to the same subset of job details...

CVE-2021-21533

Wyse Management Suite versions up to 3.2 contains a vulnerability wherein a malicious authenticated user can cause a denial of service in the job status retrieval page, also affecting other users that would have normally access to the same subset of job details...

Wyse Management Suite 输入验证错误漏洞

Wyse Management Suite is a next-generation management solution that enables you to centrally configure, monitor, manage and optimize Wyse thin clients. A denial of service vulnerability exists in Wyse Management Suite versions prior to 3.2. An attacker could exploit this vulnerability to cause a...

CVE-2021-29646

An issue was discovered in the Linux kernel before 5.11.11. tipcnlretrievekey in net/tipc/node.c does not properly validate certain data sizes, aka CID-0217ed2848e8...

Cisco IOS Software Common Industrial Protocol Privilege Escalation (cisco-sa-XE-SAP-OPLbze68)

A vulnerability in the CLI command permissions of Cisco IOS Software could allow an authenticated, local attacker to retrieve the password for Common Industrial Protocol CIP and then remotely configure the device as an administrative user. This vulnerability exists because incorrect permissions a...

CVE-2021-29156

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key...

Code injection

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key...

CVE-2021-1392

CVE-2021-1392 : A vulnerability in the CLI command permissions of Cisco IOS and IOS XE Software could let an authenticated, local attacker retrieve the CIP password via the show cip security command and then reconfigure the device as an administrative user. Root cause: incorrect permissions on th...

CVE-2021-1392 Cisco IOS and IOS XE Software Common Industrial Protocol Privilege Escalation Vulnerability

A vulnerability in the CLI command permissions of Cisco IOS and Cisco IOS XE Software could allow an authenticated, local attacker to retrieve the password for Common Industrial Protocol CIP and then remotely configure the device as an administrative user. This vulnerability exists because...

SQL Injection Vulnerability in SemCms Frontend

SemCms is an open source foreign trade enterprise website management system, mainly used for foreign trade enterprises. SemCms front-end SQL injection vulnerability , attackers can use the vulnerability to obtain database sensitive information...

Aruba Networks AirWave Management Platform XML External Entity Injection Vulnerability

Aruba Networks AirWave Management Platform is a suite of network management software for multi-vendor management from Aruba Networks. The software provides real-time monitoring, proactive alerting and historical data reporting. An XML External Entity Injection XXE vulnerability exists in the web...

Google Chrome Policy Enforcement Deficiency Vulnerability (CNVD-2021-17299)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. An insufficient policy enforcement vulnerability exists in appcache in Google Chrome versions prior to 89.0.4389.72. A remote attacker can exploit this vulnerabilit...

CloudBees Jenkins Repository Connector Plugin Cross-Site Scripting Vulnerability

Jenkins Repository Connector is a Jenkins open source application plugin . Provides a repository from Nexus or Artifactory or the like to retrieve artifacts or deploy artifacts from it , as well as the realization of the repository layout of the static server . A cross-site script execution...

CS Money: Origin IP found, Cloudflare bypassed

Greetings!, Hope Y'all good and fine. Summary: I would like to report another vulnerability very Similar to my other report in 975991 Due to lack of secure design, I was able to find the origin IPs behind Cloludflare WAF. The IPs I found belong to : 3d.cs.money Description: I was able to find and...