OpenEMR 日志信息泄露漏洞

OpenEMR is an open source medical management system from the OpenEMR Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing requests. A security vulnerability exists in OpenEMR 6.0.0 that originates from an...

Openkm OpenKM 跨站脚本漏洞

Openkm OpenKM is a document management system from the Spanish company OpenKM Openkm. The system provides features such as version control, document history, and file sharing. A cross-site scripting vulnerability exists in OpenKM Community Edition, which stems from the product's uuid field failin...

CVE-2021-28625

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 and below is affected by a Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

libgd 信任管理问题漏洞

libgd is an open source library for dynamically creating images that supports the creation of charts, graphs, thumbnails, etc. by Thomas Boutell, an individual developer in the United States. A trust management issue vulnerability exists in libgd, which stems from the fact that in GNOME libgda...

PT-2021-22565 · Gnome +2 · Gnome Libgda +2

Name of the Vulnerable Software and Affected Versions: GNOME libgda versions prior to 6.0.1 Description: The issue is related to the failure to enable TLS certificate verification on the SoupSessionSync objects created in gda-web-provider.c, making users susceptible to network man-in-the-middle...

CVE-2021-37711

Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin...

CVE-2021-37586

The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user with Administrator rights to replay a previously recorded conversation of another tenant due to insufficient validation...

CVE-2021-37704

PhpFastCache is a high-performance backend cache system packagist package phpfastcache/phpfastcache. In versions before 6.1.5, 7.1.2, and 8.0.7 the phpinfo can be exposed if the /vendor is not protected from public access. This is a rare situation today since the vendor directory is often located...

Cohesity Linux agent 安全漏洞

Cohesity Linux agent is used in different installer packages to provide support for multiple Linux distributions. A security vulnerability exists in Cohesity Linux agent, which stems from the product's lack of an effective privilege management mechanism. The vulnerability can be exploited to gain...

Microchip MiWi 安全漏洞

Microchip MiWi is a proprietary wireless protocol from Microchip that supports point-to-point star network connections. A security vulnerability exists in Microchip MiWi v6.5 that can bypass privilege authentication for illegal operation...

CVE-2021-36168

A Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in Fortinet FortiPortal 6.x before 6.0.5, FortiPortal 5.3.x before 5.3.6 and any FortiPortal before 6.2.5 allows authenticated attacker to disclosure information via crafted GET request with malicious parameter values...

SeedDMS 跨站请求伪造漏洞

SeedDMS formerly known as LetoDMS and MyDMS is a set of open source document management system based on PHP and MySql . The system is primarily used for storing and sharing documents. A cross-site request forgery vulnerability exists in SeedDMS v5.1.x 5.1.23 and v6.0.x 6.0.16. A remote attacker...

Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

...

PT-2021-3695 · Fetchmail +8 · Fetchmail +8

Name of the Vulnerable Software and Affected Versions: Fetchmail versions prior to 6.4.20 Description: The issue is related to the report vbuild function in report.c, which sometimes omits initialization of the vsnprintf va list argument. This might allow mail servers to cause a denial of service...

UBUNTU-CVE-2021-36092

It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG OTRS Community Edition:6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior version...

CVE-2021-20562

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.53 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

UBUNTU-CVE-2020-22283

A buffer overflow vulnerability in the icmp6sendresponsewithaddrsandnetif function of Free Software Foundation lwIP version git head allows attackers to access sensitive information via a crafted ICMPv6 packet...

CVE-2021-1600

Multiple vulnerabilities in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access sensitive internal services from an external interface. These vulnerabilities are due to insufficient restrictions for IPv4 or IPv6 packets that are received on the external...

lwip 缓冲区错误漏洞

lwip is an open source TCP/IP stack implementation. lwip suffers from a buffer error vulnerability that originates in the icmp6sendresponsewithaddrsandnetif function of the git head of the Free Software Foundation version of lwIP, which allows an attacker to exploit the vulnerability via a crafte...

CVE-2021-2454

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.24. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...