Internet Routing Registry Daemon 安全漏洞

Internet Routing Registry Daemon IRRd is a routing registry daemon. A security vulnerability exists in Internet Routing Registry Daemon, which stems from the fact that IRRd does not always filter password hashes in query responses related to "mntner" objects and database exports. An attacker coul...

PT-2022-16886

Name of the Vulnerable Software and Affected Versions IR Rd versions 4.2.0 through 4.2.2 Description The issue is related to the Internet Routing Registry daemon version 4, which is an IRR database server processing IRR objects in the RPSL format. IRRd did not always filter password hashes in que...

CVE-2022-25816

Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable without authentication...

in cortezaproject/corteza-server

Description During testing it was found that if a user revoke his all active session, then also user is able to make changes to his account. Proof of Concept 1. Log in to the application 2. Go to profilelogin sessions and revoke all sessions. 3. You will see that all other sessions are still vali...

IBM Cognos Controller 授权问题漏洞

IBM Cognos Controller is a business intelligence and planning solution from IBM Corporation. The product features process automation, financial audit controls, and the creation and management of financial reports.An authorization issue vulnerability exists in IBM Cognos Controller, which stems fr...

Design/Logic Flaw

The Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe are used to configure certains settings in AMC2 devices. The tool allows putting a password protection on configured devices to restrict access to the configuration of an AMC2. An attacker can circumvent this protection and make...

CVE-2021-23843

The CVE-2021-23843 affects Bosch AMC2 devices via AccessIPConfig.exe and AmcIpConfig.exe, where password protection on the device configuration can be bypassed, allowing unauthorized changes to configuration data and potentially making the device unresponsive on the local network. The vulnerabili...

Bosch Amc2 访问控制错误漏洞

Bosch Amc2 is an access modular controller from Bosch, Germany. An access control error vulnerability exists in the Bosch AMC2 that stems from the Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe used to configure certain settings in the AMC2 device. The tools allow password protection...

CVE-2021-45732

Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools,...

CVE-2021-31566

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. ...

CVE-2021-39341

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the loggedinorhasapikey function in the /OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with...

CVE-2021-20120

The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. This means that an attacker could make configuration changes such as changing the administrative password without the consent of the user...

CommScope Arris Surfboard Sb8200 跨站请求伪造漏洞

The CommScope Arris Surfboard Sb8200 is a Docsis 3.1 modem from CommScope USA. The Arris Surfboard SB8200 suffers from a security vulnerability that stems from the lack of any protection against cross-site request forgery attacks in the software's administrative web interface. This means that an...

CVE-2021-33723

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could change the user profile of any user without proper authorization. With this, the attacker could change the password of any user in the affected system...

CVE-2021-22262

Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 with Jira Cloud integration enabled allows Jira users without administrative privileges to add and remove Jira Connect...

CVE-2021-22262

Removed by vendor...

PT-2021-21381

Name of the Vulnerable Software and Affected Versions WordPress Media File Renamer – Auto & Manual Rename plugin versions = 5.1.9 Description A Cross-Site Request Forgery CSRF issue affects the plugin, allowing unauthorized changes to uploaded media. The affected parameters are post title,...

PT-2021-22991

Name of the Vulnerable Software and Affected Versions HashiCorp Terraform Enterprise versions up to v202108-1 Description The issue concerns an API endpoint that incorrectly disclosed a sensitive URL to authenticated users. This could potentially be exploited for privilege escalation or to make...

CVE-2020-24130

A cross site request forgery CSRF vulnerability in the configure.html component of Ponzu 0.11.0 allows attackers to change user and administrator credentials, and add or delete administrator accounts...

Postmortem on U.S. Census Hack Exposes Cybersecurity Failures

Threat actors exploited an unpatched Citrix flaw to breach the network of the U.S. Census Bureau in January in an attack that was ultimately halted before a backdoor could be installed or sensitive data could be stolen, according to a report by a government watchdog organization. However,...