Aggregator

OpenCMS 17.0 - Stored Cross Site Scripting (XSS)

IBMi Navigator 7.5 - HTTP Security Token Bypass

Plane 0.23.1 - Server side request forgery (SSRF)

IBMi Navigator 7.5 - Server Side Request Forgery (SSRF)

Ivanti Connect Secure 22.7R2.5 - Remote Code Execution (RCE)

ABB Cylon Aspect 3.08.02 (licenseServerUpdate.php) - Stored Cross-Site Scripting

ABB Cylon Aspect 3.08.02 (licenseUpload.php) - Stored Cross-Site Scripting

ABB Cylon Aspect 3.08.02 (uploadDb.php) - Remote Code Execution

ABB Cylon Aspect 3.08.02 (bbmdUpdate.php) - Remote Code Execution

ABB Cylon Aspect 3.08.02 (escDevicesUpdate.php) - Denial of Service (DOS)

ABB Cylon Aspect 3.08.02 (webServerUpdate.php) - Input Validation Config Poisoning

ABB Cylon Aspect 3.08.03 (CookieDB) - SQL Injection

ABB Cylon Aspect 3.07.02 (userManagement.php) - Weak Password Policy

ABB Cylon Aspect 3.08.03 (MapServicesHandler) - Authenticated Reflected XSS

ABB Cylon Aspect 3.08.03 - Hard-coded Secrets

ABB Cylon Aspect 3.08.02 - Cookie User Password Disclosure

Cacti 1.2.26 - Remote Code Execution (RCE) (Authenticated)

In ZDI-23-1527 and ZDI-23-1528 we uncover two possible scenarios where attackers could have compromised the Microsoft PC Manager supply chain.

为师生提供无缝、高质量的网络接入服务。

文章从Redis的功能和使用背景出发，分析了Redis不同版本的功能带来的安全漏洞，并提出防护方法。