CVE-2022-21283

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows...

CVE-2021-36167

An improper authorization vulnerabiltiy CWE-285 in FortiClient Windows versions 7.0.0 and 6.4.6 and below and 6.2.8 and below may allow an unauthenticated attacker to bypass the webfilter control via modifying the session-id paramater...

CVE-2021-23263

Crafter CMS (Crafter Engine) is affected. Unauthenticated remote attackers can read textual content via FreeMarker from /scripts/, /templates/ , and some non-binary files in /.git/* due to a security/configuration issue in FreeMarker rendering. Vulnerability details across sources consistently id...

Contact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads PoC fetch"https://example.com/wp-admin/admin-ajax.php", "headers": "content-type":...

CVE-2021-31851

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into the Policy Auditor web-based interface...

Vulnerabilities found in RPKI validators

Researchers at the University of Twente have found vulnerabilities found in several RPKI validators. RPKI validators are used to validate that a route propagated via BGP originates from an AS that is authorized to distribute this route. propagation. The vulnerabilities make it possible for an...

CVE-2021-34773

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM, Cisco Unified Communications Manager Session Management Edition Unified CM SME, and Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P could allow an unauthenticated,...

WordPress Delete All Comments Easily plugin cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. WordPress Delete All Comments Easily plugin in version 1.3 and earlier is vulnerable to cross-site request forgery, which can ...

Vulnerabilities fixed in Cisco Webex

Vulnerabilities have been fixed in Cisco Webex. The vulnerabilities marked CVE-2021-1500 and CVE-2021-40128 allow an unauthenticated remote malicious person able to trick a user to trick a user into opening a rogue Web page. The vulnerability with reference CVE-2021-40115 allows a malicious perso...

Employee Record Management System 1.2 SQL Injection

Title: Employee Record Management System 1.2 - 'empid' SQL injection Unauthenticated Exploit Author: Anubhav Singh Date: 2021-10-31 Vendor Homepage: https://phpgurukul.com/employee-record-management-system-in-php-and-mysql/ Version: 1.2 Software Link:...

CVE-2021-31361

An Improper Check for Unusual or Exceptional Conditions vulnerability combined with Improper Handling of Exceptional Conditions in Juniper Networks Junos OS on QFX Series and PTX Series allows an unauthenticated network based attacker to cause increased FPC CPU utilization by sending specific IP...

Remote file inclusion

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

Juniper Networks Junos OS 代码问题漏洞

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The OS provides a secure programming interface and the Junos SDK. Juniper Networks Junos OS is vulnerable to a code issue that could allow an unauthenticated attacker to cause a denial of...

CVE-2021-34742

Cisco Vision Dynamic Signage Director is affected by a reflected XSS in its web-based management interface due to insufficient validation of user-supplied input. An unauthenticated, remote attacker can lure a user to click a crafted link, potentially executing arbitrary script code in the interfa...

PT-2021-4741 · Cisco · Cisco Ios Xe +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software affected versions not specified Cisco IOS XE Software affected versions not specified Description: A vulnerability in the Link Layer Discovery Protocol LLDP message parser could allow an attacker to trigger a reload of an...

CVE-2021-3801

Insufficient Regular Expression Complexity in prismjs leads to a Regular Expression Denial of Service ReDoS attack. An unauthenticated attacker can exploit this flaw to cause an application to consume an excess amount of CPU by providing a crafted HTML comment as input. This can result in a denia...

CVE-2021-37184

Siemens Industrial Edge Management is affected by CVE-2021-37184. All versions prior to v1.3 are vulnerable to an authorization bypass where an unauthenticated attacker could change the password of any user, enabling impersonation of any valid user on the system. The root cause is described as a ...

Siemens SINEMA Remote Connect Server 安全漏洞

Siemens SINEMA Remote Connect Server is a remote network management platform from Siemens, Germany. The platform is used to remotely access, maintain, control and diagnose the underlying network. A security vulnerability exists in Siemens SINEMA Remote Connect Server versions prior to 3.0 SP2,...

CVE-2021-36163

Summary: CVE-2021-36163 affects Apache Dubbo when using the Hessian protocol. The HessianSkeleton can be created without configuring the serialization factory, bypassing the dubbo type-list checks. As a result, the generic service is exposed, so an attacker may not need a valid service/method nam...

Security Bulletin: Vulnerabilities in IBM Java Runtime Affect IBM Sterling Secure Proxy (CVE-2020-27221, CVE-2020-14782)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling Secure Proxy. IBM Sterling Secure Proxy has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-27221 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a stack-based buffer...