CVE-2021-20016

CVE-2021-20016 is a SQL Injection vulnerability in SonicWall SSLVPN SMA100 (build 10.x). The description confirms remote unauthenticated access to usernames/passwords and session data. Connected sources reiterate SonicWall SSLVPN/SMA100 and CVE mention but provide no additional technical specific...

CVE-2020-28653

CVE-2020-28653 affects ManageEngine OpManager SumPDU Java Deserialization in OpManager 12.1–12.5.x prior to build 125203 (released before 125233). The SUMPDU servlet allows unauthenticated remote code execution via deserialization of arbitrary Java objects, enabling remote code execution on the s...

CVE-2020-2506

CVE-2020-2506 affects QNAP Systems Inc. Helpdesk prior to version 3.0.3, due to improper access control that could allow an attacker to gain privileges or read sensitive information. The issue is documented across multiple sources (NVD, CNVD, CVELIST, PT-Security, Nessus QSA-20-08) and is referen...

CVE-2020-2507

CVE-2020-2507 is a command injection vulnerability in QNAP QTS Helpdesk prior to version 3.0.3. Exploitation could allow remote attackers to execute arbitrary commands with no authentication, as reported in multiple sources. The issue is tied to Helpdesk (improper access control) and is reference...

CVE-2020-25506

Summary of vulnerability (CVE-2020-25506) : D-Link DNS-320 firmware v2.06B01 Revision Ax is vulnerable to a command-injection in the system_mgr.cgi component. The issue arises because the HTTP parameter f_ntp_server is not sanitized, enabling remote arbitrary command execution. The NUCLEI templat...

CVE-2020-15568

TerraMaster TOS before 4.1.29 contains a dynamic class method invocation flaw in include/exportUser.php due to invalid parameter checking. An attacker can trigger a call to exec with OS commands (e.g., via the opt parameter), enabling remote code execution as root. Public guidance notes remediati...

CVE-2020-29557

The CVE-2020-29557 issue affects D-Link DIR-825 R1 devices with firmware up to 3.0.1 (pre-2020-11-20). A buffer overflow in the web interface enables pre-authentication remote code execution, i.e., an unauthenticated attacker could run arbitrary commands on the device. Related sources (OpenVAS NA...

CVE-2021-25646

CVE-2021-25646 affects Apache Druid where an authenticated user can trigger execution of user-provided JavaScript in certain requests. The root cause is improper validation that enables the server to run code with the Druid server process privileges, potentially compromising the host. Affected ve...

CVE-2021-3297

CVE-2021-3297 affects Zyxel NBG2105 devices (V1.00(AAGU.2)C0). The vulnerability is an authentication bypass where setting the login cookie to 1 grants administrator access to the device. This is evidenced by multiple connected sources (e.g., NVD entry, Nuclei template, Red Hat/CIRCL references) ...

CVE-2021-25864

Hue Magic 3.0.0 is vulnerable to local file inclusion via the res.sendFile API in hue-magic.js, allowing an attacker to fetch arbitrary files on the server. This CVE (CVE-2021-25864) is documented in multiple sources (including a Nuclei template and advisories) as an LFI with potential to expose ...

CVE-2021-3223

CVE-2021-3223 affects Node-RED-Dashboard prior to 2.26.2. A local file inclusion vulnerability arises from directory traversal in ui_base/js/..%2f, allowing an attacker to read files on the server. This is described across multiple sources (NVD entry references LFI with CVSS v3.1 base score 7.5; ...

CVE-2021-3156

CVE-2021-3156 is a heap-based buffer overflow in sudo that enables privilege escalation to root. The issue arises in the argument parsing path and is exploitable via commands using sudoedit -s with a trailing backslash, leading to memory corruption. Affected release information in the provided do...

CVE-2021-26134

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2021-26134.

Command Execution Vulnerability in NBR Router EWEB Network Management System at Riptide Networks Inc.

Ruijie Networks is a specialized network vendor with a full range of network equipment product lines and solutions, including switches, routers, software, security firewalls, wireless products, storage, and more. A command execution vulnerability exists in the EWEB network management system of...

CVE-2021-2109

CVE-2021-2109 affects Oracle WebLogic Server (Console component) across 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0. The vulnerability enables remote code execution via HTTP through a JNDI injection path, potentially allowing takeover of the WebLogic Server. Public exploit/poc code...

CVE-2021-2108

CVE-2021-2108 affects Oracle WebLogic Server (Fusion Middleware Core Components) with vulnerable version 12.1.3.0.0. The connected Red Hat/NVD/NASL/NCSC entries corroborate an unauthenticated, network-accessible issue exploitable via IIOP/T3 that can lead to takeover of WebLogic Server. The CVSS ...

CVE-2021-2021

CVE-2021-2021 affects Oracle MySQL Server (MySQL: Server: Optimizer) with affected versions 8.0.22 and earlier. It is described as an easily exploitable vulnerability allowing a high-privilege attacker with network access via multiple protocols to cause a hang or complete DoS on MySQL Server. The...

CVE-2021-2002

CVE-2021-2002 affects the MySQL Server, specifically the replication server component. Affected are 8.0.22 and earlier. The vulnerability can be exploited by a high-privileged attacker with network access via multiple protocols to cause a hang or a frequently repeatable crash (DoS) of MySQL Serve...

CVE-2020-19363

Vtiger CRM v7.2.0 exposes a directory traversal vulnerability in /libraries and /layout directories that allows an unauthenticated attacker to display hidden files and list directories. The issue is confirmed by Nuclei templates (Vtiger CRM v7.2.0 - Directory Listing) describing improper access c...

CVE-2020-36193

CVE-2020-36193 affects PHP’s PEAR Archive_Tar (Archive_Tar) up to version 1.4.11. The root cause is inadequate checking of symbolic links, enabling directory traversal for write operations inside an archive. This is a related issue to CVE-2020-28948. Mitigation: upgrade Archive_Tar to 1.4.14 or l...