CVE漏洞

OGeek|极客世界-中国程序员成长平台 › 门户 › 漏洞›CVE漏洞

RSS

CVE-2021-37631

Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't prop ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：21 | 回复：0
CVE-2021-38704

Multiple reflected cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in acc ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：19 | 回复：0
CVE-2021-38705

ClinicCases 7.3.3 is affected by Cross-Site Request Forgery (CSRF). A successful attack would consist of an authenticated user following a malicious link, resulting in arbitrary actions being carried ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：13 | 回复：0
CVE-2021-38706

messages_load.php in ClinicCases 7.3.3 suffers from a blind SQL injection vulnerability, which allows low-privileged attackers to execute arbitrary SQL commands through a vulnerable parameter.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：18 | 回复：0
CVE-2021-38707

Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：13 | 回复：0
CVE-2021-39194

kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：29 | 回复：0
CVE-2021-39496

Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：14 | 回复：0
CVE-2021-39497

eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：25 | 回复：0
CVE-2021-39499

A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` parameter in bind_email function.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：22 | 回复：0
CVE-2021-39503

PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without , , ?, =, `,.... In WriteConfig() function, an attacker can inject php code to /include/config.cache.php file.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：26 | 回复：0
CVE-2021-40143

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external r ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：21 | 回复：0
CVE-2021-32766

Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：14 | 回复：0
CVE-2021-37628

Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features (Upload Only public link shares in Nextcloud) can be bypassed using the Nextcloud Rich ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：16 | 回复：0
CVE-2021-37629

Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enum ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：31 | 回复：0
CVE-2021-39500

Eyoucms 1.5.4 is vulnerable to Directory Traversal. Due to a lack of input data sanitizaton in param tpldir, filename, type, nid an attacker can inject ../ to escape and write file to writeable direct ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：34 | 回复：0
CVE-2021-39501

EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：22 | 回复：0
CVE-2020-19765

An issue in the noReentrance() modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a reentrancy attack.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：23 | 回复：0
CVE-2020-19766

The time check operation of PepeAuctionSale 1.0 can be rendered ineffective by assigning a large number to the _duration variable, compromising access control to the application.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：24 | 回复：0
CVE-2020-19767

A lack of target address verification in the destroycontract() function of 0xRACER 1.0 allows attackers to steal tokens from victim users via a crafted script.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：15 | 回复：0
CVE-2020-19768

A lack of target address verification in the selfdestructs() function of ICOVO 1.0 allows attackers to steal tokens from victim users via a crafted script.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：18 | 回复：0
CVE-2020-19769

A lack of target address verification in the BurnMe() function of Rob The Bank 1.0 allows attackers to steal tokens from victim users via a crafted script.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：24 | 回复：0
CVE-2021-32800

Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：31 | 回复：0
CVE-2021-32801

Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption- ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：16 | 回复：0
CVE-2021-32802

Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a th ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：34 | 回复：0
CVE-2021-37145

** UNSUPPORTED WHEN ASSIGNED ** A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker to Privilege Escalation and ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：19 | 回复：0
CVE-2020-19853

BlueCMS v1.6 contains a SQL injection vulnerability via /ad_js.php.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：19 | 回复：0
CVE-2020-19855

phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：21 | 回复：0
CVE-2021-39116

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the GIF Image Reader compo ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：26 | 回复：0
CVE-2021-39121

Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest/ ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：81 | 回复：0
CVE-2021-39122

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint. Th ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：52 | 回复：0
CVE-2020-29012

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users conf ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：42 | 回复：0
CVE-2021-23404

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：47 | 回复：0
CVE-2021-36179

A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute unauthorized code or commands via crafted parameters in CLI command execution……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：42 | 回复：0
CVE-2021-36182

A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute unauthorized code or commands via ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：34 | 回复：0
CVE-2021-40377

SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaScript into a page that will then be proces ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：54 | 回复：0
CVE-2020-11264

Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：53 | 回复：0
CVE-2020-11301

Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Co ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：39 | 回复：0
CVE-2021-1904

Child process can leak information from parent process due to numeric pids are getting compared and these pid can be reused in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：37 | 回复：0
CVE-2021-1914

Loop with unreachable exit condition may occur due to improper handling of unsupported input in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Indust ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：34 | 回复：0
CVE-2021-1916

Possible buffer underflow due to lack of check for negative indices values when processing user provided input in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:39 | 阅读：33 | 回复：0