CVE漏洞

OGeek|极客世界-中国程序员成长平台 › 门户 › 漏洞›CVE漏洞

RSS

CVE-2021-37104

There is a server-side request forgery vulnerability in HUAWEI P40 versions 10.1.0.118(C00E116R3P3). This vulnerability is due to insufficient validation of parameters while dealing with some messages ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：37 | 回复：0
CVE-2021-37105

There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0. Due to the improper verification of file to be uploaded and does not strictly restrict the file access p ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：45 | 回复：0
CVE-2021-37106

There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default certificate file. The software constructs part of a command ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：39 | 回复：0
CVE-2021-29358

A buffer overflow vulnerability in FORMATS!ReadPVR_W+0xfa of Irfanview 4.57 allows attackers to cause a denial of service (DOS) via a crafted PVR file.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：37 | 回复：0
CVE-2021-29360

A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x37a of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：54 | 回复：0
CVE-2021-29361

A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x340 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：46 | 回复：0
CVE-2021-29362

A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa30 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：44 | 回复：0
CVE-2021-29363

A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa74 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.0xa74……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：47 | 回复：0
CVE-2021-29364

A buffer overflow vulnerability in Formats!ReadRAS_W+0x1001 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：45 | 回复：0
CVE-2021-29365

Irfanview 4.57 is affected by an infinite loop when processing a crafted BMP file in the EFFECTS!AutoCrop_W component. This can cause a denial of service (DOS).……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：56 | 回复：0
CVE-2021-29366

A buffer overflow vulnerability in FORMATS!GetPlugInInfo+0x2de9 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：35 | 回复：0
CVE-2021-29367

A buffer overflow vulnerability in WPG+0x1dda of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted WPG file.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:47 | 阅读：34 | 回复：0
CVE-2021-29808

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：17 | 回复：0
CVE-2021-29809

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：6 | 回复：0
CVE-2021-29811

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 stores user credentials in plain clear text which can be read by an authenticated admin user. IBM X-Force ID: 204329.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：9 | 回复：0
CVE-2021-29817

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：11 | 回复：0
CVE-2021-29818

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：17 | 回复：0
CVE-2021-29819

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：14 | 回复：0
CVE-2021-29820

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：17 | 回复：0
CVE-2021-29821

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：18 | 回复：0
CVE-2021-29856

IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 could allow an authenticated usre to cause a denial of service through the WebGUI Map Creation page. IBM X-Force ID: 205685.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：24 | 回复：0
CVE-2021-32839

sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may ca ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：28 | 回复：0
CVE-2021-38899

IBM Cloud Pak for Data 2.5 could allow a local user with special privileges to obtain highly sensitive information. IBM X-Force ID: 209575.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：25 | 回复：0
CVE-2021-32838

Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：16 | 回复：0
CVE-2020-19915

Cross Site Scripting (XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：22 | 回复：0
CVE-2020-16630

TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：18 | 回复：0
CVE-2020-26301

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：22 | 回复：0
CVE-2021-39325

The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function found in the ~/OMAPI/Output.php file which allows a ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：19 | 回复：0
CVE-2021-34650

The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which allows attackers to inject arbitrary web scripts, in versions ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：11 | 回复：0
CVE-2021-41082

Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the pr ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：10 | 回复：0
CVE-2021-39229

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them ac ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：14 | 回复：0
CVE-2021-41083

Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, that - when visited, allows them control o ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：21 | 回复：0
CVE-2021-20037

SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalation which potentially allows command execution in the host op ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：25 | 回复：0
CVE-2021-20829

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user wh ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：15 | 回复：0
CVE-2021-26333

An information disclosure vulnerability exists in AMD Platform Security Processor (PSP) chipset driver. The discretionary access control list (DACL) may allow low privileged users to open a handle and ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：11 | 回复：0
CVE-2021-31917

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as th ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：9 | 回复：0
CVE-2021-0869

In GetTimeStampAndPkt of DumpstateDevice.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：26 | 回复：0
CVE-2021-28960

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：18 | 回复：0
CVE-2021-37419

ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：11 | 回复：0
CVE-2021-37420

ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:46 | 阅读：15 | 回复：0