Google Android 安全漏洞

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. An elevation of privilege vulnerability exists in the System component of Google Android 8.1, 9, 10, and 11. An attacker could exploit this vulnerability to cause a...

BigProf Online Invoicing System 跨站脚本漏洞

BigProf Online Invoicing System OIS is an online invoicing system. A cross-site scripting vulnerability exists in Online Invoicing System OIS version 4.0, which can be exploited by an attacker to take over an administrative account by extracting a csrf token and sending a password change request,...

Google Chrome File System API Policy Enforcement Deficiency Vulnerability (CNVD-2021-28289)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A file system API policy enforcement deficiency vulnerability exists in versions of Google Chrome prior to 88.0.4324.96. A remote attacker can bypass file system...

The vulnerability of the QES operating system, related to access control deficiencies, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the QES operating system is related to deficiencies in access control. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

CVE-2020-17518

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or...

IBM Cloud Pak System 跨站脚本漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. A cross-site scripting vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit the vulnerability to embed arbitrary JavaScript code in the Web UI that could...

Hardcoded credentials

HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system...

Apache Kylin Remote Code Execution (CVE-2020-1956)

A command execution vulnerability exists in Apache kylin 2.3.2. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Information disclosure

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

Design/Logic Flaw

Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the CoScale agent container may allow a remote attacker to achieve root access with a blank password...

Security Bulletin: A security vulnerability in Node.js jison affects IBM Cloud Pak for Multicloud Management Managed Service.

Summary A security vulnerability in Node.js jison affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2020-8178 DESCRIPTION: Node.js jison could allow a remote attacker to execute arbitrary commands on the system, caused by insufficient input...

CVE-2019-7198

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS...

BookStack Injection Vulnerability

BookStack is an open source platform for building wiki documentation using PHP and Laravel from the BookStackApp Bookstackapp team. BookStack suffers from a security vulnerability that stems from the fact that in BookStack prior to version 0.30.5, users with edit page permissions could set up the...

CVE-2020-28935

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for...

Privilege Escalation

intel-microcode is vulnerable to privilege escalation. Allows an local authenticated malicious user to gain elevated privileges on the system, caused by improper conditions check. An attacker could exploit this vulnerability to escalate privileges, obtain confidential information or cause a denia...

Information Leakage Vulnerability in Numtech Mobile Campus WEB System

Ltd. is a development service provider dedicated to smart campus, and its main products include Moe School, Fusion Media Platform, Communication Platform, and so on. An information leakage vulnerability exists in the WEB system of Numtech Mobile Campus. Attackers can use the vulnerability to obta...

The vulnerability of the file system of the IoT Field Network Director software management tool allows a hacker to gain access to modify, add, or delete data.

The vulnerability of the access control function in the IoT network management software, Field Network Director, is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain access to modify, add, or...

Design/Logic Flaw

Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there...

The vulnerability of the Azure Sphere operating system, related to deficiencies in access control, allows attackers to escalate their privileges.

The vulnerability of the Azure Sphere operating system is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2020-26078

A vulnerability in the file system of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to overwrite files on an affected system. The vulnerability is due to insufficient file system protections. An attacker could exploit this vulnerability by crafting API request...