9317 matches found
CVE-2020-11537
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API...
Sql injection
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API...
CVE-2020-11537
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API...
CVE-2020-11537
ONLYOFFICE Document Server 5.5.0 is affected by a SQL Injection vulnerability that allows an attacker to execute arbitrary SQL queries via the DocID parameter of the Websocket API. Root cause: improper handling of input in the Websocket API leading to SQL injection. Impact: high/severe confidenti...
PT-2020-12674
Name of the Vulnerable Software and Affected Versions ONLYOFFICE Document Server version 5.5.0 Description A SQL Injection issue was discovered, allowing an attacker to execute arbitrary SQL queries via injection to the DocID parameter of the Websocket API. Recommendations For ONLYOFFICE Document...
CVE-2020-11537: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API...
The vulnerability of Engine.IO’s WebSocket server protocol, related to the manipulation of cross-site requests, allows attackers to perform arbitrary actions on the vulnerable system.
The vulnerability of the WebSocket protocol in the Engine.IO web server is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable system remotely...
CVE-2018-8034
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88...
Exploit for Cross-Site Request Forgery (CSRF) in Eclipse Che
CSWSH-THEIA-CVE-2020-14368 - Report target: Eclipse CHE deplo...
Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'user_password' SQL Injection
Exploit Title: Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'userpassword' SQL Injection Date: 2020-03-30 Exploit Author: Jacob Baines Vendor Homepage: http://www.grandstream.com/ Software Link: http://www.grandstream.com/support/firmware/ucm62xx-official-firmware Version: 1.0.20.20 and below...
Grandstream UCM6200 Series WebSocket 1.0.20.20 - (user_password) SQL Injection Exploit
Exploit for hardware platform in category web applications Exploit Title: Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'userpassword' SQL Injection Exploit Author: Jacob Baines Vendor Homepage: http://www.grandstream.com/ Software Link:...
Grandstream UCM6200 Series WebSocket 1.0.20.20 SQL Injection
Exploit Title: Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'userpassword' SQL Injection Date: 2020-03-30 Exploit Author: Jacob Baines Vendor Homepage: http://www.grandstream.com/ Software Link: http://www.grandstream.com/support/firmware/ucm62xx-official-firmware Version: 1.0.20.20 and below...
Grandstream UCM6200 Series WebSocket 1.0.20.20 - user_password SQL Injection
Grandstream UCM6200 Series WebSocket 1.0.20.20 - userpassword SQL Injection Exploit Title: Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'userpassword' SQL Injection Date: 2020-03-30 Exploit Author: Jacob Baines Vendor Homepage: http://www.grandstream.com/ Software Link:...
Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump
This module uses a blind SQL injection CVE-2020-5724 affecting the Grandstream UCM62xx IP PBX to dump the users table. The injection occurs over a websocket at the websockify endpoint, and specifically occurs when the user requests the challenge as part of a challenge and response authentication...
CVE-2020-10788
openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections...
CVE-2020-10788
openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections...
Design/Logic Flaw
openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections...
CVE-2020-10788
openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections...
CVE-2020-10788
CVE-2020-10788 affects openITCOCKPIT version prior to 3.7.3, where WebSocket connections use a fixed API key (1fea123e07f730f76e661bced33a94152378611e) instead of generating random keys. Root cause is the use of a static API key for WebSocket authentication, enabling potential unauthorized access...
