4725 matches found
WonderLink Yomi-Search 跨站脚本漏洞
WonderLink Yomi-Search is a WonderLink application. A multi-purpose search engine. A security vulnerability exists in Yomi-Search Ver4.22, which can be exploited to execute arbitrary script on the web browser of a user accessing a website that uses Yomi-Search...
fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and...
SEO Panel 跨站脚本漏洞
SEO Panel is a free, open source SEO optimization software. A cross-site scripting vulnerability exists in SEO Panel version 4.8.0. The vulnerability can be exploited to inject JavaScript via the type parameter in archive.php...
PT-2021-18023 · Seo Panel · Seo Panel
Name of the Vulnerable Software and Affected Versions: SEO Panel version 4.8.0 Description: A cross-site scripting issue allows remote attackers to inject JavaScript via the archive.php file in the report type parameter. Recommendations: For SEO Panel version 4.8.0, consider restricting access to...
PT-2021-6032 · Linux +8 · Linux Kernel +8
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.12.4 Description: The issue is related to an information leak in the IPv4 implementation of the Linux kernel. This leak is caused by a small hash table in net/ipv4/route.c. The vulnerability may allow a remote...
FTAPI 跨站脚本漏洞
A cross-site scripting vulnerability exists in FTAPI 4.0 - 4.10, which allows the passage of a crafted filename to an alternate text hover box in the file submission component...
shadow 安全漏洞
shadow is a suite of tools used to maintain Debian systems. A security vulnerability exists in the Debian shadow package before 4.5-1, which allows a local user to log in as a user without a password, allowing all local users to escalate privileges...
kernel: TOCTOU mismatch in the NFS client code
A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response allow for local memory corruption and possibly privilege escalation...
Nico Rehwaldt camunda-modeler 安全漏洞
Nico Rehwaldt camunda-modeler is a Nico Rehwaldt open source application. Provides an integrated modeling solution for BPMN and DMN based on bpmn.io. A security vulnerability exists in Nico Rehwaldt camunda-modeler version 4.6.0 and earlier versions that allows arbitrary file access...
Vulnerability fixed in Squid
Squid's developers have fixed a vulnerability. A authenticated user can exploit the vulnerability via an HTTP-Request Smuggling attack to still gain access gain access to services and websites that should be shielded. Squid has released updates to fix the vulnerability in Squid v 4.14 and 5.0.5...
CVE-2021-25331
Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen in specific condition...
CVE-2021-25331
Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen in specific condition...
CVE-2021-25333
Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen via scanning specific QR code...
Samsung Pay mini 信息泄露漏洞
Samsung Pay mini is a mobile application from Samsung South Korea. It provides a mobile payment function. The Samsung Pay mini application prior to v4.0.14 suffers from an information disclosure vulnerability that allows access to contact information via the lock screen under certain circumstance...
Samsung Pay mini 信息泄露漏洞
Samsung Pay mini is a mobile application from Samsung South Korea. It provides a mobile payment function. An access control error vulnerability exists in the Samsung Pay mini application prior to v4.0.14, which allows unauthorized access, under certain circumstances, to balance information on the...
CVE-2021-27839
A CSV injection vulnerability found in Online Invoicing System OIS 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to...
Online Invoicing System 注入漏洞
BigProf Online Invoicing System OIS is an online invoicing system. Online Invoicing System 4.3 suffers from an injection vulnerability that originates from CSV injection and can be exploited by an attacker to perform malicious actions...
CVE-2021-21321
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...