Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request...

CVE-2022-28992

A Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request...

PT-2022-19348 · Unknown · Online Banquet Booking System

Name of the Vulnerable Software and Affected Versions: Online Banquet Booking System version 1.0 Description: A Cross-Site Request Forgery CSRF issue allows attackers to change admin credentials via a crafted POST request. Recommendations: For Online Banquet Booking System version 1.0, consider...

Online Banquet Booking System 跨站请求伪造漏洞

Online Banquet Booking System is an online banquet booking system. version 1.0 of Online Banquet Booking System is vulnerable to cross-site request forgery. An attacker could use this vulnerability to change the administrator credentials via a specially crafted POST request...

CVE-2022-30770

Terminalfour versions 8.3.7, 8.3.x versions prior to version 8.3.8 and r 8.2.x versions prior to version 8.2.18.5 or 8.2.18.2.1 are vulnerable to XSS vulnerability that could be exploited by an attacker to mislead an administrator and steal their credentials...

UPchieve: Postgres Admin Username and Password in Plain text

Summary: Gitlab commit contains password in plain text Steps To Reproduce: Navigate to https://gitlab.com/upchieve/subway/-/commit/e0e039496321c9d62a591504d387589224660a5c Supporting Material/References: Recommendations for Fixing/Mitigation Do not disclose passwords in gitlab. Implement a check...

CVE-2022-20773

A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance VA could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability by performing ...

CVE-2022-20773

A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance VA could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability by performing ...

Cisco Umbrella 信任管理问题漏洞

Cisco Umbrella is a suite of cloud security platforms from Cisco. The platform prevents cyber threats such as phishing, malware and ransomware. A security vulnerability exists in the Cisco Umbrella Virtual Appliance VA that stems from the presence of a static SSH host key. An attacker could explo...

CVE-2020-25164

A vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to recover user credentials of the administrative interface...

CVE-2022-22549

Dell PowerScale OneFS, 8.2.x-9.3.x, contains a Improper Certificate Validation. A unauthenticated remote attacker could potentially exploit this vulnerability, leading to a man-in-the-middle capture of administrative credentials...

Online Banquet Booking System 1.0 Cross Site Request Forgery Vulnerability

Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery CSRF Date: 04/04/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/ Version: 1.0...

Online Banquet Booking System 1.0 Cross Site Request Forgery

Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery CSRF Date: 04/04/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/ Version: 1.0...

Lapsus$ ‘Back from Vacation’

The Lapsus$ data extortionists are back from a week-long “vacation,” they announced on Telegram, posting 70GB worth of data purportedly stolen from software development giant Globant. “We are officially back from a vacation,” the gang wrote on their Telegram channel, posting images of exfiltrated...

PONTON X/P Messenger 路径遍历漏洞

PONTON X/P Messenger is a highly configurable ebXML, AS/1, AS/2, AS/3 and AS/4 compliant messaging software from the German company PONTON. ponton X/P Messenger is vulnerable to a path traversal vulnerability that could be exploited by an attacker to upload executable scripts while obtaining...

File upload filter bypass leading to stored XSS

Description A User can upload .a-zhtml file e.g. ahtml, bhtml, chtml, ddhtml, AS LONG AS it ends with html with XSS payload. Upon upload, a URL with malicious html can be accessed and javascript will be executed. Proof of Concept taking chtml as example Step 1 Login to the demo portal with admin...

CVE-2021-43969

The login.jsp page of Quicklert for Digium 10.0.0 1043 is affected by both Blind SQL Injection with Out-of-Band Interaction DNS and Blind Time-Based SQL Injections. Exploitation can be used to disclose all data within the database up to and including the administrative accounts' login IDs and...

CVE-2022-20665

A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this vulnerability by sending crafted commands to the CLI. A...

CVE-2021-3551

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threa...

CVE-2021-3551

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threa...