PT-2024-38489 · Sourcecodester · Sourcecodester Car Driving School Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Car Driving School Management System version 1.0 Description: A problematic issue was found, affecting the save users function of the file admin/user/index.php. This leads to cross-site request forgery, which can be initiated...

Server-Side Template Injection

shopware/core and shopware/platform is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of the context variable in Twig templates, allowing attackers with Administration access to execute arbitrary PHP functions or methods...

CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...

CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...

Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Impact The context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. Example call from PHP: php...

Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027

The Opigno group manager project is related to Opigno LMS distribution. It allows to build the contents of learning paths, by combining together modules, courses, and other activities, ordering them, and defining conditional rules for the transitions from one step to the next one. An administrati...

Computer Laboratory Management System 1.0 Insecure Settings

============================================================================================================================================= | Title : Computer Laboratory Management System v1.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser :...

CVE-2024-41517

An Incorrect Access Control vulnerability in "/admin/benutzer/institution/rechteverwaltung/uebersicht" in Feripro = v2.2.3 allows remote attackers to get a list of all users and their corresponding privileges...

Detecting evolving threats: NetSupport RAT campaign

Cisco Talos is actively tracking multiple malware campaigns that utilize NetSupport RAT for persistent infections. These campaigns evade detection through obfuscation and updates. Snort can provide a strong defense before this malware reaches endpoints. In this first Deep Dive with NTDR, we explo...

Ibexa Admin UI 安全漏洞

Ibexa Admin UI is an open source UI interface for Ibexa. Dedicated to the Ibexa Admin UI Bundle. A security vulnerability exists in Ibexa Admin UI that stems from the file upload widget being susceptible to a cross-site scripting payload in the file name...

Security Bulletin: IBM Common Licensing's Administration And Reporting Tool (ART) and IBM LKS Administration Agent are affected by Spring Framework vulnerabilities.

Summary Multiple vulnerabilites in Spring Framework affect IBM Common Licensing. Security Vulnerablities have been addressed in IBM Common Licensing. Remediations/Fixes section address remediation actions. Vulnerability Details CVEID:CVE-2023-20863 DESCRIPTION: VMware Tanzu Spring Framework is...

Pimcore 安全漏洞

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates applications for Web content management, e-commerce frameworks and product information management. A security vulnerability exists in...

CVE-2024-40117

Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the web administration server. Not existing for SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 /...

CVE-2024-40117

Solar-Log 1000 is affected by an improper access control vulnerability that, in versions prior to v2.8.2 and build 52- 23.04.2013, can allow an attacker to obtain administrative privileges by connecting to the web administration server. The affected line items in public sources indicate no impact...

CVE-2024-40117

Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the web administration server. Not existing for SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 /...

PT-2024-28787 · Sl Base +1 · Sl Base +6

Name of the Vulnerable Software and Affected Versions: Solar-Log 1000 versions prior to v2.8.2 and build 52- 23.04.2013 Solar-Log 250, 300, 1200, 2000, SL 50 Gateway versions prior to 4.2.8 SL Base versions prior to 5.1.2 and 6.0.0 Description: The issue is related to incorrect access control,...

CVE-2024-40117

Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the web administration server. Not existing for SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 /...

Multi Store Inventory Management System 1.0 Insecure Direct Object Reference

==================================================================================================================================== | Title : Multi Store Inventory Management System v1.0 IDOR Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0....

ForIP Tecnologia Administração PABX SQL注入漏洞

ForIP Tecnologia Administração PABX is a phone system from ForIP Tecnologia. A SQL injection vulnerability exists in ForIP Tecnologia Administração PABX version 1.x. The vulnerability stems from the usuario parameter of the /login page containing a SQL injection vulnerability...

Candy Redis 2.1.2 Admin Page Disclosure

==================================================================================================================================== | Title : Candy Redis V2.1.2 HTML Form in redirect page Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64...