Vulnerabilities > Alibaba > Medium

DATE CVE VULNERABILITY TITLE RISK
2022-07-05 CVE-2021-43116 Improper Authentication vulnerability in Alibaba Nacos
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.
network
low complexity
alibaba CWE-287
6.5
2022-03-11 CVE-2021-44667 Cross-site Scripting vulnerability in Alibaba Nacos 2.0.3
A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.
network
alibaba CWE-79
4.3
2021-11-03 CVE-2021-33800 Path Traversal vulnerability in Alibaba Druid 1.2.3
In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.
network
low complexity
alibaba CWE-22
5.0
2021-04-27 CVE-2021-29442 Missing Authentication for Critical Function vulnerability in Alibaba Nacos
Nacos is a platform designed for dynamic service discovery and configuration and service management.
network
low complexity
alibaba CWE-306
5.0
2020-09-30 CVE-2020-19676 Information Exposure vulnerability in Alibaba Nacos 1.1.4
Nacos 1.1.4 is affected by: Incorrect Access Control.
network
low complexity
alibaba CWE-200
5.0
2014-09-20 CVE-2014-5976 Cryptographic Issues vulnerability in Alibaba 4.1.0.0
The alibaba (aka com.alibaba.wireless) application 4.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
5.4
2007-02-07 CVE-2007-0827 Remote Code Execution vulnerability in Alipay Password Input ActiveX Control
The Alibaba Alipay PTA Module ActiveX control (PTA.DLL) allows remote attackers to execute arbitrary code via a JavaScript function that invokes the Remove method with an invalid index argument, which is used as an offset for a function call.
network
alibaba
6.8