漏洞 - 第558页-OGeek|极客世界-中国程序员成长平台

OGeek|极客世界-中国程序员成长平台 › 门户 ›漏洞

漏洞

RSS

下级分类:

CVE漏洞

CVE-2021-37130

There is a path traversal vulnerability in Huawei FusionCube 6.0.2.The vulnerability is due to that the software uses external input to construct a pathname that is intended to identify a directory th ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：37 | 回复：0
CVE漏洞

CVE-2021-37129

There is an out of bounds write vulnerability in some Huawei products. The vulnerability is caused by a function of a module that does not properly verify input parameter. Successful exploit could cau ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：52 | 回复：0
CVE漏洞

CVE-2021-37127

There is a signature management vulnerability in some huawei products. An attacker can forge signature and bypass the signature check. During firmware update process, successful exploit this vulnerabi ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：40 | 回复：0
CVE漏洞

CVE-2021-37124

There is a path traversal vulnerability in Huawei PC product. Because the product does not filter path with special characters,attackers can construct a file path with special characters to exploit th ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：36 | 回复：0
CVE漏洞

CVE-2021-37122

There is a use-after-free (UAF) vulnerability in Huawei products. An attacker may craft specific packets to exploit this vulnerability. Successful exploitation may cause the service abnormal. Affected ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：44 | 回复：0
CVE漏洞

CVE-2021-35236

The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secur ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：53 | 回复：0
CVE漏洞

CVE-2021-35235

The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NE ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：51 | 回复：0
CVE漏洞

CVE-2021-35233

The HTTP TRACK TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that us ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：40 | 回复：0
CVE漏洞

CVE-2021-32951

WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored and controlled by the WebAccess/NMS, as ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：49 | 回复：0
CVE漏洞

CVE-2021-26610

The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary c ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：73 | 回复：0
CVE漏洞

CVE-2020-7867

An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：59 | 回复：0
CVE漏洞

CVE-2011-4574

PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses timing information based on the processor's high resolution timer (the RDTSC instruction) ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：52 | 回复：0
CVE漏洞

CVE-2011-4126

Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：54 | 回复：0
CVE漏洞

CVE-2011-4125

A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute any program as root.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：46 | 回复：0
CVE漏洞

CVE-2011-4124

Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：37 | 回复：0
CVE漏洞

CVE-2021-41866

MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：57 | 回复：0
CVE漏洞

CVE-2021-23877

Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary code as the admin user by replacing a spec ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：78 | 回复：0
CVE漏洞

CVE-2020-22864

A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor 3.1.0 allows attackers to execute arbitrary web scripts or HTML.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：55 | 回复：0
CVE漏洞

CVE-2019-3556

HHVM supports the use of an admin server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the curr ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：49 | 回复：0
CVE漏洞

CVE-2021-35499

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engin ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：59 | 回复：0
CVE漏洞

CVE-2021-41188

Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the secu ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：51 | 回复：0
CVE漏洞

CVE-2021-41185

Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：64 | 回复：0
CVE漏洞

CVE-2021-41184

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. Th ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：57 | 回复：0
CVE漏洞

CVE-2021-41183

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted c ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：44 | 回复：0
CVE漏洞

CVE-2021-41182

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted cod ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：63 | 回复：0
CVE漏洞

CVE-2021-41175

Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is pos ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：50 | 回复：0
CVE漏洞

CVE-2021-41173

Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：46 | 回复：0
CVE漏洞

CVE-2021-41172

AS_Redis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input validation and sanitization via redis ser ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：45 | 回复：0
CVE漏洞

CVE-2021-41158

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：63 | 回复：0
CVE漏洞

CVE-2021-41157

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. By default, SIP r ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：60 | 回复：0
CVE漏洞

CVE-2021-37364

OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename my ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：73 | 回复：0
CVE漏洞

CVE-2021-37363

An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.exe file located in bin folder and replace with a malicious file that would conne ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：48 | 回复：0
CVE漏洞

CVE-2021-41078

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：72 | 回复：0
CVE漏洞

CVE-2021-37372

Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low privileged user can upload malicious PHP files by updating their profile image to gain remote code execu ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：49 | 回复：0
CVE漏洞

CVE-2021-37371

Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：43 | 回复：0
CVE漏洞

CVE-2021-26609

A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type parameter makes a SQL query using unfiltered data. This vulner ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：58 | 回复：0
CVE漏洞

CVE-2021-26607

An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：59 | 回复：0
CVE漏洞

CVE-2011-4119

caml-light = 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：55 | 回复：0
CVE漏洞

CVE-2011-2195

A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed 'pat ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：53 | 回复：0
CVE漏洞

CVE-2021-41873

Penguin Aurora TV Box 41502 is a high-end network HD set-top box produced by Tencent Video and Skyworth Digital. An unauthorized access vulnerability exists in the Penguin Aurora Box. An attacker can ...……

作者：菜鸟教程小白 | 时间：2022-2-5 12:16 | 阅读：51 | 回复：0