12495 matches found
CVE-2021-44757
Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server...
Authentication flaw
Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server...
CVE-2021-44757
CVE-2021-44757 affects Zoho ManageEngine Desktop Central and Desktop Central MSP prior to 10.1.2137.9. The vulnerability enables authentication bypass, allowing an attacker to read sensitive data or upload an arbitrary ZIP file to the server due to improper authentication checks. Remediation is t...
CVE-2021-44757
Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server...
Zoho Releases Patch for Critical Flaw Affecting ManageEngine Desktop Central
Enterprise software maker Zoho on Monday issued patches for a critical security vulnerability in Desktop Central and Desktop Central MSP that a remote adversary could exploit to perform unauthorized actions in affected servers. Tracked as CVE-2021-44757, the shortcoming concerns an instance of...
Leostream Connection Broker 后置链接漏洞
Leostream Connection Broker is a vendor-neutral connection broker from Leostream, Inc. that provides a single interface to manage a range of operating systems, physical and virtual desktops, and display protocols commonly found in enterprise environments. A backlink vulnerability exists in...
Win32.MarsStealer Web Panel Information Disclosure
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/8abb41f6e7010d70c90f65fd9a740faa.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Win32.MarsStealer Web Panel Vulnerability: Unauthenticated Remote Information Disclosure Description...
SuiteCRM Cross-Site Request Forgery Vulnerability
SuiteCRM is a customer relationship management system from the SuiteCRM Suitecrm team.SuiteCRM has a cross-site request forgery vulnerability in versions prior to 7.11.21, which stems from the software's lack of token validation for cross-site request forgery. If the ZIP archive file contains PHP...
Security Bulletin: Apache commons-compress security vulnerabilities in IBM Content Manager
Summary Apache commons-compress security vulnerabilities in IBM Content Navigator ICN toolkit affecting Administration Console for Content Platform Engine ACCE Vulnerability Details CVEID: CVE-2021-35516 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an...
GO-2021-0228 Path traversal in github.com/unknwon/cae
The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...
Uncaught Exception
Overview std/archive/zip is a Go standard library package std/archive/zip Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: via the Open function in the archive/zip package when processing zip files containing entries with names composed solely of...
GO-2021-0264 Panic when opening certain archives in archive/zip
Previously, opening a zip with Reader.Open could result in a panic if the zip contained a file whose name was exclusively made up of slash characters or ".." path elements. Open could also panic if passed the empty string directly as an argument. Now, any files in the zip whose name could not be...
CVE-2021-40813
A cross-site scripting XSS vulnerability in the "Zip content" feature in Element-IT HTTP Commander 3.1.9 allows remote authenticated users to inject arbitrary web script or HTML via filenames...
CVE-2021-40813
A cross-site scripting XSS vulnerability in the "Zip content" feature in Element-IT HTTP Commander 3.1.9 allows remote authenticated users to inject arbitrary web script or HTML via filenames...
Cross site scripting
A cross-site scripting XSS vulnerability in the "Zip content" feature in Element-IT HTTP Commander 3.1.9 allows remote authenticated users to inject arbitrary web script or HTML via filenames...
CVE-2021-40813
A cross-site scripting XSS vulnerability in the "Zip content" feature in Element-IT HTTP Commander 3.1.9 allows remote authenticated users to inject arbitrary web script or HTML via filenames...
CVE-2021-40813
CVE-2021-40813 documents a cross-site scripting (XSS) vulnerability in the Zip Content feature of Element-IT HTTP Commander 3.1.9. The issue allows remote authenticated users to inject arbitrary web script or HTML via filenames. Affected software: Element-IT HTTP Commander 3.1.9; vulnerable compo...
GHSA-GQM2-2GCX-P88W Incorrect Permission Assignment for Critical Resource in Jenkins Credentials Binding Plugin
Jenkins Credentials Binding Plugin prior to 1.27.1 and 1.24.1 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it’s a zip file. Credentials...
Element-IT HTTP Commander 跨站脚本漏洞
Element-IT HTTP Commander is a server-hosted, web-based file management solution from Element-IT Germany. It provides basic functionality for working with files creating, copying, deleting, etc. and many other additional features, such as integration with cloud services, online editing of Office...