ROPium 代码问题漏洞

Ropium is an open source library/tool to make Rop-Exploits easy by the individual developer Boyan Milanov in France. It is used to help you build Rop exploits by finding and linking to widgets. A security vulnerability exists in ROPium that stems from the discovery that ROPium v3.1 contains inval...

CVE-2022-22169

An Improper Initialization vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who sends specific packets in certain orders and at specific timings to force OSPFv3 to unexpectedly enter graceful-restart GR helper mode even though...

AZL-44112 CVE-2022-0155 affecting package js-jquery 3.5.0-4

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor...

CVE-2021-45588

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS850 before 3.2.16.6...

CVE-2021-45584

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS850 before 3.2.16.6...

CVE-2021-45564

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS850 before 3.2.16.6...

CVE-2020-35210

A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service DoS via a Raft session flooding attack using Raft OpenSessionRequest messages...

PYSEC-2021-439

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths...

XXE vulnerability in performance

performance 3.20 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted XML report file that uses external entities for extraction of secrets from the Jenkins controller or...

PT-2021-23849 · Unknown · Thymeleaf-Spring5

Name of the Vulnerable Software and Affected Versions: thymeleaf-spring5 version 3.0.12 Description: The issue in thymeleaf-spring5 may lead to remote code execution when thymeleaf is combined with specific scenarios in template injection. Recommendations: For thymeleaf-spring5 version 3.0.12, at...

CVE-2021-37807

An SQL Injection vulneraility exists in https://phpgurukul.com Online Shopping Portal 3.1 via the email parameter on the /checkavailability.php endpoint that serves as a checker whether a new user's email is already exist within the database...

Cisco Firepower Threat Defense 安全漏洞

Cisco Firepower Threat Defense FTD is a suite of unified software from Cisco that provides next-generation firewall services. A security vulnerability exists in Cisco Firepower Threat Defense FTD and Cisco Adaptive Security Appliances Software ASA Software that stems from invalid access control. ...

Rocket.Chat 跨站脚本漏洞

Rocket.Chat is an open source team chat software. A cross-site scripting vulnerability exists in versions prior to Rocket.Chat 3.9, which stems from an issue with the rendering of the application's link previews that could lead to potential XSS attacks...

CVE-2021-33903

In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. However, changing the password of the root user via LANconfig does change the password of the root user for...

XYHCMS 跨站脚本漏洞

XYHCMS is a software application. A completely open source CMS content management system, simple, easy to use, secure, stable and free. A cross-site scripting vulnerability exists in XYHCMS, which stems from the product's xyhai.php?s=/Link/index link failing to adequately validate user input. The...

The software’s vulnerability involves providing a web interface for accessing GNU Mailman v3 archives and interacting with Hyperkitty lists. This vulnerability allows an attacker to gain access to confidential data.

The vulnerability of the software that provides a web interface for accessing GNU Mailman v3 archives and interacting with Hyperkitty lists is related to an error during the import of private distribution list archives, which later became publicly accessible. Exploiting this vulnerability could...

CVE-2021-36309

Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to the system may use the TACACS\Radius credentials stored to read sensitive information and use it in further attacks...

FlameCMS SQL注入漏洞

FlameCMS is an open source PHP-based content management system CMS. A SQL injection vulnerability exists in FlameCMS version 3.3.5. An attacker can exploit this vulnerability to cause SQL injection with the help of the id parameter in masterarticle.php...

CVE-2020-19157

Cross Site Scripting CSS in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter for the component '/index.php?m=ucenter&a=index'...

CVE-2021-23050

On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery CSRF-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to...