6257 matches found
CVE-2023-0164
OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function...
CVE-2023-21873
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...
Oracle MySQL 安全漏洞
Oracle MySQL is an open source relational database management system from Oracle Corporation. A security vulnerability exists in Oracle MySQL Server version 8.0.31 and prior versions. An attacker with elevated privileges who accesses the network via multiple protocols can compromise MySQL Server...
Velocidex Velociraptor 安全漏洞
Velocidex Velociraptor is a tool from Velocidex Australia that uses Velociraptor Query Language VQL queries to gather host-based status information. A security vulnerability exists in Velocidex Velociraptor that stems from the fact that Rapid7 Velociraptor allows the creation of users with...
CVE-2023-21878
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...
CVE-2022-47853
TOTOlink A7100RU V7.4cu.2313B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stable root shell through a specially constructed payload...
CVE-2022-43975
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. A vulnerability in the web server allows arbitrary files and configurations to be read via directory traversal over TCP port 8888...
CVE-2022-45440
A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17ABPC.3C0, which processes symbolic links on external storage media. A local authenticated attacker with administrator privileges could abuse this vulnerability to access the root file system by creating a...
PT-2023-19948 · Nextcloud +2 · Nextcloud Enterprise Server +3
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 24.0.8 and prior to 23.0.12 Nextcloud Enterprise Server versions prior to 24.0.8 and prior to 23.0.12 Description: The issue concerns server-side request forgery SSRF, where attackers can leverage enclosed...
PictureThisWebServer SQL注入漏洞
PictureThisWebServer is a web project. PictureThisWebServer suffers from a SQL injection vulnerability that stems from a security issue in the function router.post in the file routes/user.js, where manipulation of the parameter username/password leads to SQL injection...
golang.org/x/net/http2/h2c vulnerable to request smuggling attack
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be...
OESA-2023-1032 jetty security update
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in order to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...
Axigen 安全漏洞
Axigen is a mail server with groupware and collaboration features from Axigen. A security vulnerability exists in Axigen version 10.3.3.52, which stems from a two-step authentication issue that allows an attacker to access mailboxes without any CAPTCHA by bypassing the two-step authentication usi...
The vulnerability of the XPC CVMServer service on Mac OS operating systems allows attackers to increase their privileges.
The vulnerability of the XPC CVMServer service on Mac OS operating systems is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability can allow attackers to increase their privileges...
The vulnerability of the Web Server software on Schneider Electric’s programmable logic controllers, such as Modicon M340, Modicon Quantum, and Modicon Premium, allows attackers to disclose sensitive information or cause malfunctions in the equipment.
The vulnerability of the Web Server component of Schneider Electric’s programmable logic controllers—Modicon M340, Modicon Quantum, and Modicon Premium—is due to buffer overflow attacks. Exploiting this vulnerability allows an attacker to disclose sensitive information or cause service failures b...
The vulnerability of the Remote Desktop VPN server’s remote access service allows a hacker to execute arbitrary commands.
The vulnerability of the Remote Desktop VPN server’s remote access service is related to operations that occur outside of the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...
CVE-2022-46368 Rumpus - FTP server Cross-site request forgery (CSRF) – Create user
Rumpus - FTP server version 9.0.7.1 Cross-site request forgery CSRF – vulnerability may allow unauthorized action on behalf of authenticated users...
PT-2023-5866
Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.57 Bamboo Data Center and Server versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.1, and 9.3.0 F5 NGINX products affected versions not specified gRPC-Go versions prior to 1.56.3, 1.57.1, and 1.58.3 IBM HTTP...
