CVE-2021-36180

Multiple improper neutralization of special elements used in a command vulnerabilities CWE-77 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests...

Fortinet FortiWLM 跨站脚本漏洞

Fortinet FortiWLM is a wireless manager from Fortinet, Inc. A cross-site scripting vulnerability exists in Fortinet FortiWLM, which can be exploited by attackers to execute malicious javascript code on the victim's host via a crafted HTTP request...

CVE-2021-23859

An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local...

Fortinet FortiWeb 缓冲区错误漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A buffer overflow vulnerability exists that...

Fortinet FortiWLM SQL注入漏洞

Fortinet FortiWLM is a wireless manager from Fortinet, Inc. An SQL injection vulnerability exists in Fortinet FortiWLM versions 8.6.1 and below, which can be exploited by attackers to contaminate database data and extract sensitive information via crafted HTTP requests to be sent to alarms and...

Fortinet FortiWeb输入验证错误漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content.Fortinet FortiWeb An input validation error...

FortiWeb - Path traversal in API controller

Multiple relative path traversal vulnerabilities CWE-23 in the API of FortiWeb may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

Unitrends Backup 格式化字符串错误漏洞

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A format string error vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which stems from the creation of an HTTP request that could trigger a format string vulnerability in a privileged vaultServer...

The vulnerability in the web interface of Cisco Firepower Management Center’s software for network management allows a hacker to read or rewrite any arbitrary files.

The vulnerability of the web interface for managing Cisco Firepower Management Center FMC software involves deficiencies in path name checking for the directory. Exploiting this vulnerability allows a malicious actor to read or re-record arbitrary files using specially created HTTPS requests...

IBM Tivoli Key Lifecycle Manager 安全漏洞

IBM Tivoli Key Lifecycle Manager TKLM is a set of key lifecycle management software from IBM Corporation. The software provides key storage, key maintenance, and key lifecycle management for storage devices.A security vulnerability exists in IBM Tivoli Key Lifecycle Manager, which stems from the...

The vulnerability of the UserGate UTM corporate network interface of UserGate D500 allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the UserGate UTM corporate network interface of UserGate D500 exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to influence the confidentiality and integrity of the protected information...

CVE-2021-40127

A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an unauthenticated, remote attacker to render the web-based...

Cisco Catalyst 安全漏洞

Cisco Catalyst is a series of switches from Cisco USA. A security vulnerability exists in the Cisco Catalyst Passive Optical Network Series Switches, which is caused by incorrect HTTPS input validation in the web management interface of the Cisco Catalyst PON Series Switches ONT. An attacker coul...

Cisco Small Business 输入验证错误漏洞

Cisco Small Business is a switch from Cisco. Cisco Small Business switch An input validation error vulnerability exists, which results from improper validation of HTTP requests on a web management page. An attacker could exploit this vulnerability to cause dos by sending a crafted HTTP request to...

CVE-2021-36184

A improper neutralization of Special Elements used in an SQL Command 'SQL Injection' in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclosure device, users and database information via crafted HTTP requests...

CVE-2021-36186

A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests...

CVE-2021-36181

A concurrent execution using shared resource with improper Synchronization vulnerability 'Race Condition' in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific...

Race condition

A concurrent execution using shared resource with improper Synchronization vulnerability 'Race Condition' in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific...

CVE-2021-36181

A concurrent execution using shared resource with improper Synchronization vulnerability 'Race Condition' in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific...

CVE-2021-36181

A concurrent execution using shared resource with improper Synchronization vulnerability 'Race Condition' in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific...