CVE-2021-33687

SAP NetWeaver AS JAVA Enterprise Portal, versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attacker can use this in conjunction with other attacks such as XSS to steal this information...

IBM Security Verify Access 信息泄露漏洞

IBM Security Access Manager is a product for information security management applications from IBM, USA. The product enables access management control through integrated devices for web, mobile and cloud computing. IBM Security Access Manager Docker A log information disclosure vulnerability exis...

SAP NetWeaver AS 信息泄露漏洞

SAP NetWeaver AS is a SAP web application server from SAP, a German company. SAP NetWeaver AS JAVA has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information in HTTP requests...

The vulnerability of the Cisco Business Process Automation software lies in improper configuration of authentication for management commands and access settings to action logs, allowing attackers to escalate their privileges.

The vulnerability of the Cisco Business Process Automation software relates to incorrect authentication settings for control commands and incorrect access settings to action logs. Exploiting this vulnerability can allow a malicious actor to enhance their privileges by sending specially crafted HT...

SAP NetWeaver AS 安全漏洞

SAP NetWeaver AS is an SAP web application server from SAP, a German company. SAP NetWeaver AS for Java has a denial of service vulnerability that can be exploited by an attacker to cause a denial of service by sending multiple Http requests with different method types...

CVE-2021-24013

Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests...

CVE-2021-24013

Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests...

CVE-2021-22129

Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically...

Fortinet FortiMail 缓冲区错误漏洞

Fortinet FortiMail is a set of e-mail security gateway products of the U.S. Fita Fortinet. The product provides e-mail security and data protection features. A buffer overflow vulnerability exists in Fortinet FortiMail, which stems from a buffer size miscalculation in multiple instances. An...

FortiMail / FortiNDR / FortiWeb - Path traversal vulnerabilities

Multiple Path traversal vulnerabilities in FortiMail, FortiNDR & FortiWeb may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests...

CVE-2021-35049

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated...

Fidelis Network Deception 操作系统命令注入漏洞

Fidelis Network Deception is a security product from Fidelis USA. It is used to detect threats and prevent data loss with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats. A security vulnerability exists in Fidelis...

Vulnerability fixed in SonicWall SonicOS

A vulnerability has been fixed in SonicOS. The vulnerability allows an unauthenticated malicious party to obtain system information through a malicious http request to obtain system information. SonicWall categorizes this vulnerability according to the CVSSv3 method with a score of 5.3. SonicWall...

jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

A cross-site request forgery CSRF vulnerability was found in the config-file-provider Jenkins plugin. The plugin does not require POST requests for an HTTP endpoint which allows attackers to delete configuration files corresponding to an attacker-specified ID...

CVE-2021-22902

The actionpack ruby gem a framework for handling and responding to web requests in Rails before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch t...

CVE-2021-22902

CVE-2021-22902 refers to a denial-of-service vulnerability in Rails Action Dispatch mime-type parsing. The actionpack gem, prior to versions 6.0.3.7 and 6.1.3.2, can be exploited by specially crafted HTTP Accept headers that trigger catastrophic backtracking in the regular expression engine. The ...

Vulnerability fixed in Schneider Electric Modicon

A vulnerability has been found in the firmware of Schneider Electric Modicon X80 devices. A malicious party can exploit the exploit the vulnerability to obtain configuration data from the device. To do this, a malicious person must make a rogue request towards the web server of the system. It is...

CVE-2020-28713

Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notification events via an exposed PNS server. A remote attacker can passively record push notification events which are sent over an insecure web request. The we...

UBUNTU-CVE-2020-28713

Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notification events via an exposed PNS server. A remote attacker can passively record push notification events which are sent over an insecure web request. The we...

Cross-Site Request Forgery (CSRF)

jenkins config file provider plugin is vulnerable to cross-site request forgery CSRF. The server did not verify the authenticity of web requests and allows an attacker is able to delete configuration files corresponding to an attacker-specified ID by tricking an authenticated user to visit a...