cs.unipi.gr Cross Site Scripting vulnerability OBB-3384417

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Metasploit Weekly Wrap-Up

AD CS certificate templates Our very own Spencer McIntyre has developed a new module that allows for creating, reading, updating and deleting certificate template objects from Active Directory. ESC4 Exploitation These changes notably enables the exploitation of the technique identified as ESC4...

CVE-2022-47611

Cross-Site Request Forgery CSRF vulnerability in Julian Weinert // cs&m Hover Image plugin = 1.4.1 versions...

CVE-2022-47611 WordPress Hover Image Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Julian Weinert // cs&m Hover Image plugin = 1.4.1 versions...

CVE-2022-47611

The CVE-2022-47611 entry describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Hover Image plugin, affecting versions up to 1.4.1. Affected component: Hover Image plugin for WordPress. Root cause: CSRF vulnerability that can be triggered by an unauthenticated actor to coerc...

PT-2023-15434 · WordPress · Cs&M Hover Image Plugin

Name of the Vulnerable Software and Affected Versions: Julian Weinert // cs&m Hover Image plugin versions 1.4.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintende...

Online Computer and Laptop Store SQL注入漏洞

Online Computer and Laptop Store is an online computer and laptop store by Carlo Montero Personal Developer. A SQL injection vulnerability exists in SourceCodester Online Computer and Laptop Store version 1.0, which stems from a problem with the component GET Parameter Handler, where manipulation...

Omron CS/CJ Series

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Omron Equipment: SYSMAC CS/CJ Series Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access...

CISA Releases Four Industrial Control Systems Advisories

CISA released four Industrial Control Systems ICS advisories on April 18, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for...

Omron SYSMAC CS/CJ/CP Series 访问控制错误漏洞

The Omron SYSMAC CS/CJ/CP Series is a series of programmable controllers from Omron Corporation Japan. A security vulnerability exists in the Omron SYSMAC CS/CJ/CP Series due to a security issue with the FINS protocol that involves clear-text communication, undefined authentication, and other...

PT-2023-21095 · Omron · Sysmac Nx1P-Series Cpu Units +4

Name of the Vulnerable Software and Affected Versions: SYSMAC CS-series CPU Units, all versions SYSMAC CJ-series CPU Units, all versions SYSMAC CP-series CPU Units, all versions SYSMAC NJ-series CPU Units, all versions SYSMAC NX1P-series CPU Units, all versions SYSMAC NX102-series CPU Units, all...

Metasploit Weekly Wrap-Up

Rocket Software UniRPC Exploits Ron Bowes submitted two exploit modules for vulnerabilities he discovered in the UniRPC server for Rocket Software’s UniData product. The first exploit module, exploit/linux/misc/unidataudadminauthbypass exploits an authentication bypass to ultimately gain remote...

CVE-2020-9009

The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database via action=shipnotify because access to this endpoint is completely unchecked. The attacker must guess an order number...

CVE-2020-9009

The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database via action=shipnotify because access to this endpoint is completely unchecked. The attacker must guess an order number...

Information disclosure

The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database via action=shipnotify because access to this endpoint is completely unchecked. The attacker must guess an order number...

CVE-2023-26593

CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who can login or access the computer where the affected product is installed tampers the password file stored in the computer, the user privilege which CENTUM manag...

CVE-2023-26593

CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who can login or access the computer where the affected product is installed tampers the password file stored in the computer, the user privilege which CENTUM manag...

CVE-2020-9009

The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database via action=shipnotify because access to this endpoint is completely unchecked. The attacker must guess an order number...

PT-2023-11951 · Shipstation.Com · Shipstation.Com Plugin

Name of the Vulnerable Software and Affected Versions: ShipStation.com plugin versions 1.1 and earlier for CS-Cart Description: The issue allows remote attackers to insert arbitrary information into the database via the "action=shipnotify" endpoint because access to this endpoint is completely...

CVE-2020-9009

The CVE-2020-9009 issue affects the ShipStation.com plugin for CS-Cart, version 1.1 and earlier. Affected component: the unchecked web endpoint at action=shipnotify, which allows remote attackers to insert arbitrary data into the database. Root cause: access to the endpoint is completely unchecke...