CVE漏洞

OGeek|极客世界-中国程序员成长平台 › 门户 › 漏洞›CVE漏洞

RSS

CVE-2021-38143

An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. Howev ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：11 | 回复：0
CVE-2021-38144

An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a form via the submission_id parameter, e.g., clients/forms/edit_submission.php?for ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：13 | 回复：0
CVE-2021-38145

An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-privileged user (client) tries to export a form with data, e.g., manipulation of ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：11 | 回复：0
CVE-2021-33555

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：12 | 回复：0
CVE-2021-34559

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：14 | 回复：0
CVE-2021-34560

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's co ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：6 | 回复：0
CVE-2021-34561

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：8 | 回复：0
CVE-2021-34562

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：12 | 回复：0
CVE-2021-34563

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：14 | 回复：0
CVE-2021-34564

Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：15 | 回复：0
CVE-2021-34565

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：10 | 回复：0
CVE-2021-34578

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：11 | 回复：0
CVE-2021-34581

Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in versions FW4 up to FW15 allows an unauthentic ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：14 | 回复：0
CVE-2021-3749

axios is vulnerable to Inefficient Regular Expression Complexity……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：16 | 回复：0
CVE-2021-35219

ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：24 | 回复：0
CVE-2021-35220

Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：9 | 回复：0
CVE-2021-39316

The Zoomsounds plugin = 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory trave ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：23 | 回复：0
CVE-2021-35221

Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：15 | 回复：0
CVE-2021-35222

This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：9 | 回复：0
CVE-2020-19046

Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：11 | 回复：0
CVE-2020-19047

Cross Site Request Forgey (CSRF) in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST request to the component '/index.php?controller=systemaction=admin_edit_act&# ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：14 | 回复：0
CVE-2020-19048

Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the Title field found in the Add New Forum page by doing an authenticated POST HTTP reques ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：6 | 回复：0
CVE-2020-19049

Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the Description field found in the Add New Forum page by doing an authenticated POST HTTP ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：12 | 回复：0
CVE-2021-21677

Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerabili ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：9 | 回复：0
CVE-2021-21678

Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：19 | 回复：0
CVE-2021-21679

Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：25 | 回复：0
CVE-2021-21680

Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：15 | 回复：0
CVE-2021-21681

Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where they can be viewed by users with access to the Jenkins controll ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：10 | 回复：0
CVE-2021-29907

IBM OpenPages with Watson 8.1 and 8.2 could allow an authenticated user to upload a file that could execute arbitrary code on the system. IBM X-Force ID: 207633.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：7 | 回复：0
CVE-2021-35213

An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator u ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：8 | 回复：0
CVE-2021-35223

The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：6 | 回复：0
CVE-2021-35239

A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：6 | 回复：0
CVE-2021-35240

A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：8 | 回复：0
CVE-2021-39163

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, topic and number of members of a room if th ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：23 | 回复：0
CVE-2021-21811

A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of ATT Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：63 | 回复：0
CVE-2021-22684

Tizen RT RTOS version 3.0.GBB is vulnerable to integer wrap-around in functions_calloc and mm_zalloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected b ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：57 | 回复：0
CVE-2021-22929

An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：62 | 回复：0
CVE-2021-22943

A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained access to a network to subsequently control the Protect camera(s) assigned to sa ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：60 | 回复：0
CVE-2021-22944

A vulnerability found in UniFi Protect application V1.18.1 and earlier allows a malicious actor with a view-only role and network access to gain the same privileges as the owner of the UniFi Protect a ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：54 | 回复：0
CVE-2021-35212

An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion data ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：57 | 回复：0