40 matches found
CVE-2024-10148
creationtimestamp| type| source ---|---|--- 2024-10-25 10:23:38+00:00| seen| https://t.me/cvedetector/8902...
WordPress Awesome Buttons Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Software Awesome Buttons Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10148 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cc341f29d26e Credits Francesco Carlucci Required...
SolarWinds Orion Platform Authentication Bypass (CVE-2020-10148)
An authentication bypass vulnerability exists in SolarWinds Orion API. Successful exploitation of this vulnerability could allow a remote attacker to gain unauthorized access to the affected system...
SolarWinds Hack — New Evidence Suggests Potential Links to Chinese Hackers
A malicious web shell deployed on Windows systems by leveraging a previously undisclosed zero-day in SolarWinds' Orion network monitoring software may have been the work of a possible Chinese threat group. In a report published by Secureworks on Monday, the cybersecurity firm attributed the...
Exploit for Missing Authentication for Critical Function in Solarwinds Orion_Platform
Usage & Disclaimer This script is a batch detection script f...
CVE-2020-10148
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds...
CVE-2020-10148
CVE-2020-10148 is a vulnerability in the SolarWinds Orion API where an authentication bypass can allow a remote attacker to execute API commands, potentially compromising the Orion instance. Affected are SolarWinds Orion Platform versions 2019.4 HF5, 2020.2 with no hotfix, and 2020.2 HF1. The vul...
Exploit for Missing Authentication for Critical Function in Solarwinds Orion_Platform
CVE-2020-10148 Solarwinds Orion Download CVE-2020-10148.py...
CVE-2020-10148
creationtimestamp| type| source ---|---|--- 2020-12-28 10:40:02+00:00| exploited| https://t.me/SecLabNews/9489 2020-12-28 14:17:56+00:00| seen| https://t.me/truesecator/1296 2020-12-30 14:26:54+00:00| published-proof-of-concept| https://t.me/canyoupwnme/6698 2020-12-31 18:23:59+00:00| exploited|...
SolarWinds Orion Platform < 2019.4 HF6 / 2020.2 < 2020.2.1 HF2 Authentication Bypass (SUPERNOVA)
The version of SolarWinds Orion Platform running on the remote host is prior to 2019.4 HF6 or 2020.2 prior to 2020.2.1 HF 2. It is, therefore, affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this, via a specially crafted web request, to bypass...
SolarWinds SUNBURST Backdoor Supply Chain Attack: What You Need to Know
On Dec. 12, 2020, FireEye provided detailed information on a widespread attack campaign involving a backdoored component of the SolarWinds Orion platform, which is used by organizations to monitor and manage IT infrastructure. FireEye has given the campaign an identifier of UNC2452 and is further...
CVE-2018-10148
CVE-2018-10148 is rejected/not used per the Initial Description.
CVE-2017-10148
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Core Components. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to...
CVE-2017-10148
CVE-2017-10148 affects Oracle WebLogic Server (Core Components) in 10.3.6.0, 12.1.3.0, 12.2.1.1, 12.2.1.2. The connected ERPScan entry includes a PoC demonstrating anonymous log injection over a T3 connection, enabling an unauthenticated remote attacker to inject data into WebLogic logs. The vuln...
Anonymous log injection in FSCM
Application: Oracle PeopleSoft Versions Affected: PeopleSoft FSCM 9.2 Vendor: Oracle Bug: Anonymous log injection Reported: 16.03.2017 Vendor response: 17.03.2017 Date of Public Advisory: 18.07.2017 Reference: Oracle CPU July 2017 Authors: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...
CVE-2016-10148
The wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a getplugindata call before checking the updateplugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to...
CVE-2016-10148
The wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a getplugindata call before checking the updateplugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to...
CVE-2016-10148
The CVE-2016-10148 entry concerns WordPress before 4.6. The vulnerable component is wp_ajax_update_plugin in wp-admin/includes/ajax-actions.php. The root cause is that a get_plugin_data call is performed before checking the update_plugins capability, allowing remote authenticated users to bypass ...