DEBIAN-CVE-2021-32640

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected]...

PT-2021-7661 · Unknown · Checkbox Survey

Name of the Vulnerable Software and Affected Versions: Checkbox Survey versions prior to 7. Description: The issue is related to the deserialization of untrusted data in the CheckboxWeb.dll library of the Checkbox Survey software. This allows a remote attacker to execute arbitrary code...

Knowage Cross-Site Scripting Vulnerability (CNVD-2021-34493)

Knowage is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A cross-site scripting vulnerability exists in Knowage Suite version 7.3. An attacker can inject arbitrary web scripts via the "targetService" parameter...

Elasticsearch Logstash 信任管理问题漏洞

Elasticsearch Logstash is a suite of log analysis and monitoring tools from the Dutch company Elasticsearch. A security vulnerability exists in Logstash. The vulnerability stems from a TLS certificate validation vulnerability in the program's monitoring feature, which could allow a...

CVE-2021-30214

Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter...

Adobe Genuine Integrity Service 输入验证错误漏洞

Adobe Genuine Service is a free service that periodically verifies that the Adobe applications on your computer are genuine and notifies customers if they are not. An insecure file permission vulnerability exists in Adobe Genuine Service 7.1 and earlier versions. An attacker could exploit the...

com.github.liuzhenghui:weaver-ecology-parent (>=9.00.2110.07.220316 <=9.00.2112.03.220528) potentially affected by CVE-2020-25020 via net.sf.mpxj:mpxj (=7.4.3)

net.sf.mpxj:mpxj MAVEN version =7.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.mpxj:mpxj and may be impacted: - com.github.liuzhenghui:weaver-ecology-parent =9.00.2110.07.220316, =9.00.2112.03.220528 Source cves: CVE-2020-25020 Source...

Pax Technology PAXSTORE 安全漏洞

PAX Technology PAXSTORE is an application from China PAX PAX Inc. An ecosystem that connects 2.5 million terminals, thousands of application developers and 180+ markets in 80+ countries worldwide. An information disclosure vulnerability exists in Pax Technology PAXSTORE version v7.0.8202005111715...

CVE-2021-20397

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196017...

IBM QRadar SIEM 信任管理问题漏洞

QRadar SIEM is an IBM enterprise security information and event management product that consolidates log event and network flow data from thousands of devices, endpoints and applications scattered across the network. A hard-coded credentials vulnerability exists in IBM QRadar SIEM versions 7.3 an...

IBM QRadar SIEM 代码问题漏洞

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. A security...

IBM QRadar SIEM 路径遍历漏洞

QRadar SIEM is an IBM enterprise security information and event management product that consolidates log event and network flow data from thousands of devices, endpoints and applications scattered across the network. A path traversal vulnerability exists in the way IBM QRadar SIEM versions 7.3 an...

CVE-2020-18022

Cross Site Scripting XSS in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js" component...

TYPO3 代码问题漏洞

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Typo3 Association. A server-side request forgery vulnerability exists in TYPO3 versions prior to 7.2.1, which stems from a failure to check the legitimacy of a request. An attacker can exploit this...

PT-2021-18762 · Telegram · Telegram

Name of the Vulnerable Software and Affected Versions: Telegram app version 7.6.2 for iOS Description: The issue allows remote authenticated users to cause a denial of service, resulting in an application crash, if the victim pastes an attacker-supplied message, such as one in the Persian languag...

CVE-2021-27394

A vulnerability has been identified in Mendix Applications using Mendix 7 All versions V7.23.19, Mendix Applications using Mendix 8 All versions V8.17.0, Mendix Applications using Mendix 8 V8.12 All versions V8.12.5, Mendix Applications using Mendix 8 V8.6 All versions V8.6.9, Mendix Applications...

IBM Spectrum Protect 缓冲区错误漏洞

IBM Spectrum Protect is a data protection platform that provides organizations with a single point of control and management for backup and recovery.IBM Spectrum Protect Server is the server of the... A stack buffer overflow vulnerability exists in IBM Spectrum Protect Server versions 7.1 and 8.1...

pczupil X2CRM 跨站脚本漏洞

pczupil X2CRM is a pczupil open source application. A next generation open source social selling application for small and medium sized businesses. A cross-site scripting vulnerability exists in pczupil X2CRM version 7.1, which can be exploited to inject arbitrary web script or HTML via the...

Cisco IOS XR 参数注入漏洞

Cisco IOS XR software is a modular and fully distributed network operating system for service provider networks. A command injection vulnerability exists in the CLI of Cisco IOS XR versions prior to 7.3.1. The vulnerability stems from insufficient input validation of user-supplied commands. An...

Proofpoint Insider Threat Management Server 安全漏洞

Proofpoint Insider Threat Management Server is a server-side application from Proofpoint, Inc. for preventing malicious operations by enterprise insiders. An authorization bypass vulnerability exists in Proofpoint Insider Threat Management Server versions prior to 7.11.1, which stems from the...