12422 matches found
Snipe-IT 跨站请求伪造漏洞
Snipe-IT is an open source IT asset/license management system. Snipe-IT is vulnerable to cross-site request forgery, which stems from a lack of csrf checksum for POST requests in the software's view.blade.php file, and can be exploited by attackers to launch cross-site request forgery attacks...
VulnCheck KEV: CVE-2017-18368
Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remotehost parameter of the ViewLog.asp page...
Mozilla Firefox Security Advisory (MFSA2015-149) - Linux
This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
Improper privilege management in Keycloak
A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission...
sqlite: mishandling of certain SELECT statements with non-existent VIEW can lead to DoS
SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash...
Design/Logic Flaw
Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard...
Cloudera Manager 安全漏洞
Cloudera Manager is an end-to-end application for managing CDH clusters.An incorrect access control vulnerability exists in Cloudera Manager version 7.2.4. An attacker could exploit the vulnerability to elevate privileges and view restricted dashboards...
channel-view.co.uk Improper Access Control vulnerability OBB-2234678
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2021-33210
An issue was discovered in Fimer Aurora Vision before 2.97.10. An attacker can in the WebUI obtain plant information without authentication by reading the response of APIs from a kiosk view of a plant...
CVE-2021-33210
An issue was discovered in Fimer Aurora Vision before 2.97.10. An attacker can in the WebUI obtain plant information without authentication by reading the response of APIs from a kiosk view of a plant...
Authentication flaw
An issue was discovered in Fimer Aurora Vision before 2.97.10. An attacker can in the WebUI obtain plant information without authentication by reading the response of APIs from a kiosk view of a plant...
CVE-2021-41312
Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and disable Issue Collectors on Jira Service Management projects via an Improper Authentication vulnerability in the /secure/ViewCollectors...
Fimer Aurora 授权问题漏洞
Fimer Aurora is a scalable web-based power plant management platform from Fimer Italy. It is used to enable customers to remotely manage solar power plants in a variety of markets. Fimer Aurora suffers from an authorization issue vulnerability that arises from obtaining plant information without...
Fortinet FortiManager 信息泄露漏洞
Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and...
PT-2021-23267 · Atlassian · Jira Service Management Server +1
Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.19.1 Description: The issue allows a remote attacker who has had their access revoked from Jira Service Management to enable and disable Issue Collectors on Jira Service Management...
Stylish Cost Calculator < 7.04 - Subscriber+ Unauthorised AJAX Calls to Stored XSS
The plugin does not have any authorisation and CSRF checks on some of its AJAX actions available to authenticated users, which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users d...
The vulnerability of the TemplateDetailView function in the django/contrib/admindocs component of the Django web application’s software platform, related to vulnerabilities in pathname restrictions for directories, allows attackers to gain access to confidential data.
The vulnerability of the TemplateDetailView function in the django/contrib/admindocs component of the Django software development platform relates to shortcomings in pathname restrictions for directories. Exploiting this vulnerability could allow an attacker to gain access to confidential data...
CVE-2021-41312
Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and disable Issue Collectors on Jira Service Management projects via an Improper Authentication vulnerability in the /secure/ViewCollectors...
Nextcloud 安全漏洞
Nextcloud is an open source set of self-hosted file synchronization and sharing communication applications platform from Germany-based Nextcloud. Nextcloud Deck is vulnerable to an access control error in versions prior to 1.2.9, 1.4.5 and 1.5.3. The vulnerability stems from a lack of permission...