CVE-2021-24005

Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow an attacker with access to the files or the CLI configuration to decrypt the sensitive data, via knowledge of the hard-coded key...

CVE-2021-20743

Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin for EC-CUBE 3.0 series versions prior to version 1.0.4 allows a remote attacker to inject an arbitrary script by leading a user to a specially crafted page and to perform a specific operation...

CVE-2021-20744

Cross-site scripting vulnerability in EC-CUBE Category contents plugin for EC-CUBE 3.0 series versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation...

UBUNTU-CVE-2021-3605

There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability...

PT-2021-3455 · Symfony · Symfony

Name of the Vulnerable Software and Affected Versions: Symfony versions 5.3.0 through 5.3.1 Description: A vulnerability in Symfony is related to firewall authentication. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other...

ECShop SQL Injection Vulnerability (CNVD-2021-44948)

ECShop is a professional e-commerce mall system. A SQL injection vulnerability exists in ECShop version 3.0. An attacker can exploit this vulnerability by using the id parameter of admin/shophelp.php to perform SQL injection attacks...

ECShop SQL注入漏洞

ECShop is a professional e-commerce mall system. A SQL injection vulnerability exists in ECShop version 3.0. An attacker can exploit this vulnerability by using the aid parameter of admin/affiliateck.php to conduct SQL injection attacks...

CVE-2021-28814

An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.4...

Thycotic Password Reset Server 信息泄露漏洞

Thycotic Password Reset Server is a password reset server from Thycotic, U.S.A. A security vulnerability exists in versions of Thycotic Password Reset Server prior to 5.3.0, which stems from the password reset server allowing credentials to be exposed. An attacker could exploit the vulnerability ...

PT-2021-20792 · Unknown · Kiali-Operator

Name of the Vulnerable Software and Affected Versions: kiali-operator versions prior to 1.33.0 kiali-operator versions prior to 1.24.7 Description: An incorrect access control flaw was found in the kiali-operator. This flaw allows an attacker with a basic level of access to the cluster to deploy ...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. It used to call Kernelopen to open a local file. If a Ruby project hasa file whose name starts with | and ends with tags, the command followingthe pipe character is executed. A malicious Ruby project could exploit it...

UBUNTU-CVE-2021-28658

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability...

CVE-2021-3479

There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability...

AZL-45363 CVE-2021-3475 affecting package OpenEXR 2.3.0-6

There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an integer overflow, potentially leading to problems with application availability...

VulnCheck KEV: CVE-2020-2507

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3...

CVE-2021-27190

A Stored Cross Site ScriptingXSS Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can ste...

PT-2021-3618 · Django +3 · Django +3

Name of the Vulnerable Software and Affected Versions: Django versions 2.2 before 2.2.18 Django versions 3.0 before 3.0.12 Django versions 3.1 before 3.1.6 Description: The issue is related to the django.utils.archive.extract method, which is used by "startapp --template" and "startproject...

CVE-2020-29019

A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated attacker to crash the httpd daemon thread by sending a request with a crafted cookie header...

PT-2021-3438 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 6.3.0 through 6.3.7 FortiWeb versions prior to 6.2.4 FortiWeb versions 6.3.11 and earlier Description: A blind SQL injection in the user interface of FortiWeb may allow an unauthenticated, remote attacker to execute arbitrar...

CVE-2020-4747

IBM Connect:Direct for UNIX 6.1.0, 6.0.0, 4.3.0, and 4.2.0 can allow a local or remote user to obtain an authenticated CLI session due to improper authentication methods. IBM X-Force ID: 188516...