Privilege escalation

The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage function...

CVE-2021-38490

Altova MobileTogether Server before 7.3 SP1 allows XML exponential entity expansion, a different vulnerability than CVE-2021-37425...

golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header

A vulnerability was detected in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and subsequent denial of service. This vulnerability affects both clients and servers written in Go, however, servers are only vulnerable if the value of MaxHeaderBytes...

Altova MobileTogether Server 代码问题漏洞

Altova MobileTogether Server is a server from Altova Austria that provides MobileTogether solutions for client mobile devices. A security vulnerability exists in Altova MobileTogether Server versions prior to 7.3 SP1, which can be exploited by an attacker to read certificates and private keys...

PT-2021-7495 · Mariadb +10 · Mariadb Server +10

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions 10.6 and below Description: The issue is related to an use-after-free in the my strcasecmp 8bit component of MariaDB Server, which can be exploited through specially crafted SQL statements, potentially allowing a remot...

TTiny Java Web Server 跨站脚本漏洞

TTiny Java Web Server is a lightweight web server written in Java. A cross-site scripting vulnerability exists in TTiny Java Web Server and Servlet Container TJWS =1.115, which allows an adversary to inject malicious code into the server's "404 Page not Found" error page...

PT-2021-15267 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat server versions prior to 3.13.2 Rocket.Chat server versions prior to 3.12.4 Rocket.Chat server versions prior to 3.11.4 Description: A sanitization issue exists in the Rocket.Chat server that allows queries to an endpoint,...

CVE-2021-3351

OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page...

PT-2021-7502 · Mariadb +10 · Mariadb Server +10

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions 10.6.3 and below Description: The issue is related to a use-after-free vulnerability in the Item func in::cleanup component of the MariaDB Server, which can be exploited by a remote attacker using specially crafted SQL...

CVE-2020-5329

Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links...

Micro Focus SUSE Linux Enterprise Server 后置链接漏洞

Micro Focus SUSE Linux Enterprise Server is a suite of enterprise server edition Linux operating systems from Micro Focus in the United Kingdom. A security vulnerability exists in Micro Focus SUSE Linux Enterprise Server, which stems from potentially dangerous file system operations in...

The vulnerability of the X.org server, related to a countable loss of significance, allows a perpetrator to access confidential information or cause service failures.

The vulnerability of the X.org server is related to a countable amount of significance loss. Exploiting this vulnerability can allow an attacker to access confidential information or cause service failures...

CVE-2021-2437

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2021-2440

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

CVE-2021-2389

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server...

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

UBUNTU-CVE-2021-2422

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PS. Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of...

CVE-2021-2383

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2021-22706

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions...

Oracle MySQL Server has an unspecified vulnerability (CNVD-2021-54680)

Oracle MySQL Server, a relational database from Oracle Corporation, is vulnerable in the Server: GIS component of Oracle MySQL Server 8.0.25 and earlier. An attacker can use this vulnerability to cause MySQL Server to hang or crash frequently and repeatedly complete denial of service, as well as...