CVE漏洞

OStack程序员社区-中国程序员成长平台 › 门户 › 漏洞›CVE漏洞

RSS

CVE-2021-22820

A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：76 | 回复：0
CVE-2021-22821

A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended network targets when crafted malicious parameters are submit ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：99 | 回复：0
CVE-2021-22822

A CWE-79 Improper Neutralization of Input During Web Page Generation (?Cross-site Scripting?) vulnerability exists that could allow an attacker to impersonate the user who manages the charging station ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：82 | 回复：0
CVE-2021-22825

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system with elevated privileges when a privileged account clicks o ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：84 | 回复：0
CVE-2021-22826

A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload. This CVE is unique from CVE-2021-22827. ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：89 | 回复：0
CVE-2021-22827

A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload. This CVE is unique from CVE-2021-22826. ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：90 | 回复：0
CVE-2021-23174

Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions = 4.4.6) Vulnerable parameters: post_title, downloadable_file_versi ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：80 | 回复：0
CVE-2021-23863

HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when successfully exploited allows an attacker to inject random HTML code into a component lo ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：89 | 回复：0
CVE-2021-26264

A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition.……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：74 | 回复：0
CVE-2021-27654

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：88 | 回复：0
CVE-2021-31567

Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions = 4.4.6). The plugin allows arbitrary files, including sensitive configuration fi ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：68 | 回复：0
CVE-2021-40338

Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates error ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：84 | 回复：0
CVE-2021-40339

Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploit this vulnerability to retrieve sensitive information. This ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：77 | 回复：0
CVE-2021-40340

Information Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP.net information, an attacker that manages to exploit this v ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：64 | 回复：0
CVE-2021-40388

A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：82 | 回复：0
CVE-2021-40389

A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM aut ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：110 | 回复：0
CVE-2021-40396

A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authori ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：92 | 回复：0
CVE-2021-40397

A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM auth ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：118 | 回复：0
CVE-2021-40404

An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to authentication bypass. An a ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：93 | 回复：0
CVE-2021-40406

A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to prevent users from lo ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：108 | 回复：0
CVE-2021-40407

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At or , based on DDNS type, the ddns-domain variable, that has the v ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：125 | 回复：0
CVE-2021-40408

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At or , based on DDNS type, the ddns-username variable, that has the ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：115 | 回复：0
CVE-2021-40409

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At or , based on DDNS type, the ddns-password variable, that has the ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：102 | 回复：0
CVE-2021-40410

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At the dns_data-dns1 variable, that has the value of the dns1 parame ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：124 | 回复：0
CVE-2021-40411

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At the dns_data-dns2 variable, that has the value of the dns2 parame ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：134 | 回复：0
CVE-2021-40412

An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At the devname variable, that has the value of the name parameter pro ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：106 | 回复：0
CVE-2021-40413

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradePrepare is the API that checks if a provid ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：114 | 回复：0
CVE-2021-40414

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The SetMdAlarm API sets the movement detection parame ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：133 | 回复：0
CVE-2021-40415

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. In cgi_check_ability the Format API does not have a s ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：112 | 回复：0
CVE-2021-40416

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get APIs that are not included in cgi_check_a ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：119 | 回复：0
CVE-2021-40419

A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of network requests can lead to arbitrary firmware update. An ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：108 | 回复：0
CVE-2021-40423

A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of HTTP requests can lead to denial o ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：93 | 回复：0
CVE-2021-44463

Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some De ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：98 | 回复：0
CVE-2021-4034

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users ac ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：129 | 回复：0
CVE-2022-21134

A firmware update vulnerability exists in the quot;updatequot; firmware checks functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to firmware update. An a ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：101 | 回复：0
CVE-2022-21199

An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：104 | 回复：0
CVE-2022-21217

An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to an out-of-bounds write. An at ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：121 | 回复：0
CVE-2022-21236

An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a disclosure of sensitive ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：126 | 回复：0
CVE-2022-21796

A memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to an out-of-bounds write. ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：116 | 回复：0
CVE-2022-21801

A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to a reboot. An attacker can ...……

作者：菜鸟教程小白 | 时间：2022-2-5 13:09 | 阅读：104 | 回复：0