Oracle Essbase 安全漏洞

Oracle Hyperion and Oracle Essbase are products of Oracle Corporation.Oracle Hyperion is a set of financial modeling applications. The software provides financial closure, report production, etc. Oracle Essbase is an application. Enables organizations to quickly generate insights from...

PT-2023-3699 · Oracle · Hyperion Essbase Administration Services

Name of the Vulnerable Software and Affected Versions: Oracle Hyperion Essbase Administration Services version 21.4.3.0.0 Description: The issue is related to insufficient input validation in the EAS Administration and EAS Console components of Oracle Hyperion Essbase Administration Services. Thi...

Oracle Application Express 安全漏洞

Oracle Application Express is the United States Oracle Oracle, a low-code development platform. A security vulnerability in Application Express Administration in Oracle Application Express can be exploited by an attacker to cause unauthorized update, insertion, or deletion access to certain...

PT-2023-8303 · D Link · D-Link Dir-X3260

Name of the Vulnerable Software and Affected Versions: D-Link DIR-X3260 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. The flaw exists within the prog.cgi binary, which...

PT-2023-8298 · D Link · D-Link Dir-X3260

Name of the Vulnerable Software and Affected Versions: D-Link DIR-X3260 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. The specific flaw exists within the prog.cgi binary,...

UBUNTU-CVE-2023-37278

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in version 10.0.9...

CVE-2023-37278

GLPI (Asset and IT Management software) is affected by SQL injection vulnerabilities disclosed across multiple sources. The initial CVE-2023-37278 entry states an administrator can trigger SQL injection via dashboards administration, with a patch available in version 10.0.9. Connected documents d...

CVE-2023-29452 Remove possibility to add html into Geomap attribution field

Currently, geomap configuration Administration - General - Geographical maps allows using HTML in the field “Attribution text” when selected “Other” Tile provider...

GLPI vulnerable to SQL injection via dashboard administration

[email protected] reports: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in...

ELECOM WRC 命令注入漏洞

The ELECOM WRC is a network camera for the home from ELECOM Japan. A command injection vulnerability exists in the ELECOM WRC-1167GHBK-S v1.03 and earlier and WRC-1167GBBK-S v1.03 and earlier, which originates from a vulnerability that allows network-adjacent authenticated attackers to execute...

PT-2023-8862 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.9 Description: The issue is related to SQL injection via dashboards administration, allowing a remote attacker to execute arbitrary SQL queries. This can be triggered by an administrator. Recommendations: For...

CVE-2023-29298

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC...

Improper access control

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC...

CVE-2023-29298 Adobe ColdFusion Improper Access Control Security feature bypass

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC...

Hard-coded credentials in Technicolor TG670 DSL gateway router

Overview The Technicolor TG670 DSL Gateway Router includes a hard-coded service account that allows for authentication over services on the WAN interface, using HTTP, SSH, or TELNET. The authenticated user can use it to gain full administrative control of the router. Description A hard-coded...

TravianZ 代码注入漏洞

TravianZ is a free-to-play, in-browser, web-based strategy game from German company Travian. A security vulnerability exists in TravianZ version 8.3.4, 8.3.3, which stems from a PHP injection in the configuration editor of the administration page that allows remote attackers to execute PHP code...

Taking over Milesight UR32L routers behind a VPN: 22 vulnerabilities and a full chain

Cisco Talos discovered 17 vulnerabilities 63 CVEs in the Milesight UR32L router and five vulnerabilities six CVEs in the Milesight MilesightVPN remote access solution software. An attacker could exploit the vulnerabilities discovered to completely compromise the UR32L and MilesightVPN. This post...

GZ Forum Script 1.8 - Stored Cross-Site Scripting Vulnerability

Exploit Title: GZ Forum Script 1.8 - Stored Cross-Site Scripting XSS Exploit Author: CraCkEr Vendor: GZ Scripts Vendor Homepage: https://gzscripts.com/ Software Link: https://gzscripts.com/gz-forum-script.html Version: 1.8 Tested on: Windows 10 Pro Impact: Manipulate the content of the site Relea...

Car Rental Script 1.8 - Stored Cross-site scripting (XSS)

Exploit Title: Car Rental Script 1.8 - Stored Cross-site scripting XSS Date: 30/07/2023 Exploit Author: CraCkEr Vendor: GZ Scripts Vendor Homepage: https://gzscripts.com/ Software Link: https://gzscripts.com/car-rental-php-script.html Version: 1.8 Tested on: Windows 10 Pro Impact: Manipulate the...

Car Rental Script 1.8 - Stored Cross-site scripting Vulnerability

Exploit Title: Car Rental Script 1.8 - Stored Cross-site scripting XSS Exploit Author: CraCkEr Vendor: GZ Scripts Vendor Homepage: https://gzscripts.com/ Software Link: https://gzscripts.com/car-rental-php-script.html Version: 1.8 Tested on: Windows 10 Pro Impact: Manipulate the content of the si...