漏洞 - 第643页-OGeek|极客世界-中国程序员成长平台

OGeek|极客世界-中国程序员成长平台 › 门户 ›漏洞

漏洞

RSS

下级分类:

CVE漏洞

CVE-2021-35240

A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：8 | 回复：0
CVE漏洞

CVE-2021-35239

A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：6 | 回复：0
CVE漏洞

CVE-2021-35223

The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：6 | 回复：0
CVE漏洞

CVE-2021-35213

An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator u ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：8 | 回复：0
CVE漏洞

CVE-2021-29907

IBM OpenPages with Watson 8.1 and 8.2 could allow an authenticated user to upload a file that could execute arbitrary code on the system. IBM X-Force ID: 207633.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：7 | 回复：0
CVE漏洞

CVE-2021-21681

Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where they can be viewed by users with access to the Jenkins controll ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：10 | 回复：0
CVE漏洞

CVE-2021-21680

Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：15 | 回复：0
CVE漏洞

CVE-2021-21679

Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：25 | 回复：0
CVE漏洞

CVE-2021-21678

Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：19 | 回复：0
CVE漏洞

CVE-2021-21677

Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerabili ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：9 | 回复：0
CVE漏洞

CVE-2020-19049

Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the Description field found in the Add New Forum page by doing an authenticated POST HTTP ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：12 | 回复：0
CVE漏洞

CVE-2020-19048

Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the Title field found in the Add New Forum page by doing an authenticated POST HTTP reques ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：6 | 回复：0
CVE漏洞

CVE-2020-19047

Cross Site Request Forgey (CSRF) in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST request to the component '/index.php?controller=systemaction=admin_edit_act&# ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：14 | 回复：0
CVE漏洞

CVE-2020-19046

Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：11 | 回复：0
CVE漏洞

CVE-2021-35222

This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：9 | 回复：0
CVE漏洞

CVE-2021-35221

Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：15 | 回复：0
CVE漏洞

CVE-2021-39316

The Zoomsounds plugin = 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory trave ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：23 | 回复：0
CVE漏洞

CVE-2021-35220

Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：9 | 回复：0
CVE漏洞

CVE-2021-35219

ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：24 | 回复：0
CVE漏洞

CVE-2021-3749

axios is vulnerable to Inefficient Regular Expression Complexity……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：16 | 回复：0
CVE漏洞

CVE-2021-34581

Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in versions FW4 up to FW15 allows an unauthentic ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：14 | 回复：0
CVE漏洞

CVE-2021-34578

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：11 | 回复：0
CVE漏洞

CVE-2021-34565

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：10 | 回复：0
CVE漏洞

CVE-2021-34564

Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：15 | 回复：0
CVE漏洞

CVE-2021-34563

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：14 | 回复：0
CVE漏洞

CVE-2021-34562

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：12 | 回复：0
CVE漏洞

CVE-2021-34561

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：8 | 回复：0
CVE漏洞

CVE-2021-34560

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's co ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：6 | 回复：0
CVE漏洞

CVE-2021-34559

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：14 | 回复：0
CVE漏洞

CVE-2021-33555

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：12 | 回复：0
CVE漏洞

CVE-2021-38145

An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-privileged user (client) tries to export a form with data, e.g., manipulation of ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：11 | 回复：0
CVE漏洞

CVE-2021-38144

An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a form via the submission_id parameter, e.g., clients/forms/edit_submission.php?for ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：13 | 回复：0
CVE漏洞

CVE-2021-38143

An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. Howev ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：11 | 回复：0
CVE漏洞

CVE-2021-40330

git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhos ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：18 | 回复：0
CVE漏洞

CVE-2021-36981

In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：25 | 回复：0
CVE漏洞

CVE-2021-36356

KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：13 | 回复：0
CVE漏洞

CVE-2020-13639

A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store ma ...……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：21 | 回复：0
CVE漏洞

CVE-2021-27558

A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creator.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：28 | 回复：0
CVE漏洞

CVE-2021-27557

A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：27 | 回复：0
CVE漏洞

CVE-2021-27556

The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System.……

作者：菜鸟教程小白 | 时间：2022-2-5 11:37 | 阅读：16 | 回复：0