PT-2021-19199 · Evolucare · Evolucare Ecsimaging

Name of the Vulnerable Software and Affected Versions: EVOLUCARE ECSIMAGING aka ECS Imaging versions 6.21.5 and earlier Description: The issue affects the login form and the password-forgotten form, such as /req password user.php?email=, allowing an attacker to steal data in the database and obta...

CuteSoft Cute Editor Cross-Site Scripting Vulnerability

CuteSoft Cute Editor is a U.S. CuteSoft company can be used to edit PHP and ASP HTML editor. A cross-site scripting vulnerability exists in Cute Editor for ASP.NET version 6.4, which allows remote attackers to execute scripts in the victim's web browser using specially crafted URLs...

Gotenberg Directory Traversal Vulnerability (CNVD-2021-03336)

Gotenberg is a Docker-powered stateless API for converting HTML, Markdown and Office documents to PDF. A directory traversal vulnerability exists in Gotenberg 6.2.1 and earlier versions of the Markdown engine. An attacker can exploit this vulnerability to read any container file...

PT-2021-2854 · Oracle +2 · Virtualbox +2

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.20 Description: The issue is related to incorrect handling of drdynvc packets in the Core component of Oracle VM VirtualBox. This can be exploited by a remote attacker to execute arbitrary code or ga...

Lan ATMService M3 ATM Monitoring System Directory Traversal Vulnerability

Lan ATMService M3 ATM Monitoring System is a software for monitoring ATM machines from the Russian company Lan ATMService. A directory traversal vulnerability exists in Lan ATMService M3 ATM Monitoring System 6.1.0. An attacker can use this vulnerability to view log files in /websocket/logs/ that...

CVE-2020-27336

An issue was discovered in Treck IPv6 before 6.0.1.68. Improper input validation in the IPv6 component when handling a packet sent by an unauthenticated remote attacker could result in an out-of-bounds read of up to three bytes via network access...

Treck TCP/IP 缓冲区错误漏洞

Treck TCP/IP is a suite of TCP Transmission Control Protocol/IP Internet Interconnection Protocol from Treck, Inc. dedicated to embedded systems. An input validation error vulnerability exists in Treck TCP/IP stack Version 6.0.1.67, which stems from an input validation error in the IPv6 component...

Mitel BusinessCTI Enterprise Client Input Validation Error Vulnerability

Mitel Networks BusinessCTI Enterprise is an employee communication software for attendance management and instant messaging from Mitel Networks Canada. An input validation error vulnerability exists in the Windows-based Mitel BusinessCTI Enterprise MBC-E Client Chat Window versions prior to 6.4.1...

CVE-2020-8461

A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a victim's browser to send a specifically encoded request without requiring a valid CSRF token...

Trend Micro InterScan Web Security Virtual Appliance 授权问题漏洞

Trend Micro InterScan Web Security Virtual Appliance IWSVA is a Web security gateway from Trend Micro that provides dynamic, integrated security protection for enterprise networks against Web-based threats. A command execution vulnerability exists in Trend Micro InterScan Web Security Virtual...

CVE-2020-27147

The REST API component of TIBCO Software Inc.'s TIBCO PartnerExpress contains a vulnerability that theoretically allows an unauthenticated attacker with network access to obtain an authenticated login URL for the affected system via a REST API. Affected releases are TIBCO Software Inc.'s TIBCO...

kernel: The flow_dissector feature allows device tracking

A device tracking vulnerability was found in the flowdissector feature in the Linux kernel. This flaw occurs because the auto flowlabel of the UDP IPv6 packet relies on a 32-bit hashmd value as a secret, and jhash instead of siphash is used. The hashmd value remains the same starting from boot ti...

CVE-2019-19286

A vulnerability has been identified in XHQ All Versions 6.1. The web interface could allow SQL injection attacks if an attacker is able to modify content of particular web pages...

CVE-2020-24445

AEM's Cloud Service offering, as well as version 6.5.6.0 and below, are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2020-24445

AEM's Cloud Service offering, as well as version 6.5.6.0 and below, are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

picoTCP-NG and picoTCP Input Validation Error Vulnerabilities

Contiki is an open source cross-platform operating system for IoT Internet of Things devices.Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. An input validation error vulnerability exists in picoTCP-NG and picoTCP that stems from no...

Contiki 缓冲区错误漏洞

Contiki is an open source, highly portable, networked multitasking operating system for memory-constrained systems. A denial of service and remote code execution vulnerability exists in the IPv6 stack in Contiki 3.0 and earlier versions. The vulnerability stems from insufficient checking of the...

CVE-2020-4718

IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2020-28054

JamoDat TSMManager Collector version up to 6.5.0.21 is vulnerable to an Authorization Bypass because the Collector component is not properly validating an authenticated session with the Viewer. If the Viewer has been modified binary patched and the Bypass Login functionality is being used, an...

TSMManager Collector Information Disclosure Vulnerability

Tsmmanager TSMManager Collector is a software that enables monitoring, management, operation, and control of Distributed Storage Managers, Tivoli Storage Managers, and Disk Storage Managers from TSMManager Tsmmanager, USA. An information disclosure vulnerability exists in JamoDat TSMManager...