Headline
CVE-2021-37254: Vulnerability Disclosure
In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server.
Related news
This advisory contains mitigations for mproper Access Control, Unrestricted Upload of File with Dangerous Type, Open Redirect, Cross-site Scripting, and Cross-site Request Forgery vulnerabilities in Uffizio GPS Tracker software.
Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS).
A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devices credential information via configuration page lookup.
The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point.
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server.