Güncel Güvenlik Açıkları

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses. Devamını Oku Kaynak: NIST

Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation. Devamını Oku Kaynak: NIST

Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled. Devamını Oku Kaynak: NIST

An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export. Devamını Oku Kaynak: NIST

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. Devamını Oku Kaynak: NIST

Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. Devamını Oku Kaynak: NIST

Improper Authorization in GitHub repository webmin/webmin prior to 1.990. Devamını Oku Kaynak: NIST

jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS). Devamını Oku Kaynak: NIST

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.2, 6.4.7 and 6.2.9 may allow a low privileged authenticated user to gain access to the FortiGate users credentials via the config conflict file. Devamını Oku Kaynak: NIST

An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user. Devamını Oku Kaynak: NIST

An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may allow an authenticated attacker to execute unauthorized commands by running CLI commands with specifically crafted arguments. Devamını Oku Kaynak: NIST