漏洞 - 第336页-OGeek|极客世界-中国程序员成长平台

OGeek|极客世界-中国程序员成长平台 › 门户 ›漏洞

漏洞

RSS

下级分类:

CVE漏洞

CVE-2021-23760

The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：248 | 回复：0
CVE漏洞

CVE-2021-23558

The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in (https://security.snyk ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：93 | 回复：0
CVE漏洞

CVE-2021-23484

The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：59 | 回复：0
CVE漏洞

CVE-2022-23889

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments.……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：30 | 回复：0
CVE漏洞

CVE-2022-23888

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：31 | 回复：0
CVE漏洞

CVE-2022-23887

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete.……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：38 | 回复：0
CVE漏洞

CVE-2022-23979

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions = 3.0.15).……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：28 | 回复：0
CVE漏洞

CVE-2022-23727

There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specific operation to exploit this vulnerability. Exploitation may ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：22 | 回复：0
CVE漏洞

CVE-2022-23456

Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：26 | 回复：0
CVE漏洞

CVE-2022-22994

A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insuf ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：20 | 回复：0
CVE漏洞

CVE-2022-22993

A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：16 | 回复：0
CVE漏洞

CVE-2022-22992

A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerab ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：16 | 回复：0
CVE漏洞

CVE-2022-22938

VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueTyp ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：15 | 回复：0
CVE漏洞

CVE-2022-22791

SYNEL - eharmony Authenticated Blind Stored XSS. Inject JS code into the comments field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system.……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：14 | 回复：0
CVE漏洞

CVE-2022-22790

SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the Name parameter the attacker can r ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：14 | 回复：0
CVE漏洞

CVE-2022-21801

A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to a reboot. An attacker can ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：14 | 回复：0
CVE漏洞

CVE-2022-21796

A memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to an out-of-bounds write. ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：14 | 回复：0
CVE漏洞

CVE-2022-21236

An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a disclosure of sensitive ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：14 | 回复：0
CVE漏洞

CVE-2022-21217

An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to an out-of-bounds write. An at ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：13 | 回复：0
CVE漏洞

CVE-2022-21199

An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：14 | 回复：0
CVE漏洞

CVE-2022-21134

A firmware update vulnerability exists in the quot;updatequot; firmware checks functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to firmware update. An a ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：14 | 回复：0
CVE漏洞

CVE-2021-4034

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users ac ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：11 | 回复：0
CVE漏洞

CVE-2021-44463

Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some De ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：9 | 回复：0
CVE漏洞

CVE-2021-40423

A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of HTTP requests can lead to denial o ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：9 | 回复：0
CVE漏洞

CVE-2021-40419

A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of network requests can lead to arbitrary firmware update. An ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：9 | 回复：0
CVE漏洞

CVE-2021-40416

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get APIs that are not included in cgi_check_a ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：9 | 回复：0
CVE漏洞

CVE-2021-40415

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. In cgi_check_ability the Format API does not have a s ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：9 | 回复：0
CVE漏洞

CVE-2021-40414

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The SetMdAlarm API sets the movement detection parame ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：7 | 回复：0
CVE漏洞

CVE-2021-40413

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradePrepare is the API that checks if a provid ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：8 | 回复：0
CVE漏洞

CVE-2021-40412

An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At the devname variable, that has the value of the name parameter pro ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：9 | 回复：0
CVE漏洞

CVE-2021-40411

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At the dns_data-dns2 variable, that has the value of the dns2 parame ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：9 | 回复：0
CVE漏洞

CVE-2021-40410

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At the dns_data-dns1 variable, that has the value of the dns1 parame ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：8 | 回复：0
CVE漏洞

CVE-2021-40409

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At or , based on DDNS type, the ddns-password variable, that has the ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：8 | 回复：0
CVE漏洞

CVE-2021-40408

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At or , based on DDNS type, the ddns-username variable, that has the ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：7 | 回复：0
CVE漏洞

CVE-2021-40407

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At or , based on DDNS type, the ddns-domain variable, that has the v ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：7 | 回复：0
CVE漏洞

CVE-2021-40406

A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to prevent users from lo ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：7 | 回复：0
CVE漏洞

CVE-2021-40404

An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to authentication bypass. An a ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：7 | 回复：0
CVE漏洞

CVE-2021-40397

A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM auth ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：7 | 回复：0
CVE漏洞

CVE-2021-40396

A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authori ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：7 | 回复：0
CVE漏洞

CVE-2021-40389

A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM aut ...……

作者：菜鸟教程小白 | 时间：2022-6-23 07:52 | 阅读：7 | 回复：0