Directory traversal

Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory...

Employee Task Management System 1.0 Privilege Escalation Vulnerability

Employee Task Management System - Broken Authentication leads to compromise of all application accounts by changing the password CVE Assigned: CVE-2023-0905 mitre.org, nvd.nist.org Author Email: email protected Vendor Homepage: https://www.sourcecodester.com Software Link: Employee Task Managemen...

CVE-2022-45697

Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory...

CVE-2022-45697

Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory...

CSRF leading to edit admin accounts

Description GET /admin/accounts/id/edit/?activetab=default page is vulnerable to a CSRF attack. Proof of Concept Login as admin. try to edit admin accounts example id=4 Open the following file in the browser. history.pushState'', '', '/'; document.forms0.submit;...

Auto Dealer Management System 1.0 Privilege Escalation

Auto Dealer Management System - Broken Access Control leads to compromise of all application accounts by accessing the ?page=user/list with low privileged user account Date: 18 February 2023 Author Email: [email protected] Vendor Homepage: https://www.sourcecodester.com Software Link: Au...

CVE-2023-20011

A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system...

CVE-2023-20011 Cisco Application Policy Infrastructure Controller and Cisco Cloud Network Controller Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system...

PT-2023-19298 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat server versions prior to 5.2.0 Description: A prototype pollution issue exists that could allow an attacker to achieve remote code execution RCE under the admin account. This vulnerability may affect cloud infrastructure, as any...

CVE-2023-20011

A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system...

Attackers Flood NPM Repository with Over 15,000 Spam Packages Containing Phishing Links

In what's a continuing assault on the open source ecosystem, over 15,000 spam packages have flooded the npm repository in an attempt to distribute phishing links. "The packages were created using automated processes, with project descriptions and auto-generated names that closely resembled one...

Captcha Bypass due to invalidation of previous tokens

Description An attacker can create bypass the captcha mechanism and create multiple accounts directly Proof of Concept 1: Sign up with a new name in the application, fill the captcha and intercept the request of the submit. The request will look something like this POST...

K14229: OpenSSH vulnerability CVE-2007-2768

Security Advisory Description OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar...

K21595932: Samba vulnerability CVE-2018-1057

Security Advisory Description On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service...

K54252492: Side-channel processor vulnerability CVE-2018-3693

Security Advisory Description Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis. CVE-2018-3693 also known as Spectre ...

PT-2023-2844 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 8.8.15 through 9.0 Description: The issue is related to a lack of account status check when sending emails using 2FA two-factor authentication in Zimbra Collaboration Suite. This can allow a remote attacker t...

CVE-2023-24080

A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 on iOS allows attackers to compromise user accounts via a bruteforce attack...

CVE-2022-44216

Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without knowing victim's original password...

FreeBSD : MinIO -- unprivileged users can create service accounts for admin users (8e20430d-a72b-11ed-a04f-40b034455553)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8e20430d-a72b-11ed-a04f-40b034455553 advisory. - MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A...

PayPal Scammers Using Legitimate Accounts to Send Phishing Invoices

By Deeba Ahmed Scammers are creating legit PayPal accounts and sending phishing invoices to unsuspected users and since the email comes from [email protected] chances of falling for this scam are more than usual. This is a post from HackRead.com Read the original post: PayPal Scammers Using...