7789 matches found
Authorization
Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints...
CVE-2021-43939
CVE-2021-43939 affects Elcomplus SmartPTT (SCADA/server endpoints). The vulnerability is improper authorization (CWE-285) that lets a low-authenticated user issue requests to admin-level endpoints, enabling privilege escalation with high impact to confidentiality, integrity and availability. Affe...
CVE-2021-43939 Elcomplus SmartPtt Improper Authorization
Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints...
RHEL 7 : web-admin-build (RHSA-2022:1628)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1628 advisory. Red Hat Gluster Storage Web Administration includes a fully automated setup based on Ansible and provides deep metrics and insights into active Glust...
OpenEMR Cross-Site Scripting Vulnerability (CNVD-2022-61334)
OpenEMR is an open source medical management system from the OpenEMR community. A cross-site scripting vulnerability exists in versions of OpenEMR prior to 6.1.0.1, which stems from a lack of data validation filters for user-supplied data and output data in the file name on the "Upload Document...
The vulnerability of the EAS Console component of the Oracle Hyperion Essbase Administration Services allows a perpetrator to execute arbitrary code.
The vulnerability of the EAS Console component of the Oracle Hyperion Essbase Administration Services exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via HTTP requests...
Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty may affect IBM Spectrum Protect for Workstations Central Administration Console (CVE-2021-39031)
Summary IBM Spectrum Protect for Workstations Central Administration Console requires the dependent product IBM WebSphere Application Server Liberty. Information about a security vulnerability affecting IBM WebSphere Application Server Liberty has been published in a security bulletin. Refer to t...
QNAP QTS / QuTS Hero Default Credentials
The remote QNAP QTS or QuTS Hero web administration interface uses a known set of hard-coded default credentials. An attacker can exploit this to gain administrative access to the remote host. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...
CVE-2021-45839
It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint...
OpenEMR 跨站脚本漏洞
OpenEMR is an open source medical management system from the OpenEMR community. A cross-site scripting vulnerability exists in versions of OpenEMR prior to 6.1.0.1, which stems from a lack of data validation filters for user-supplied data and output data in the file name on the "Upload Document...
KiteCMS 安全漏洞
KiteCMS is a website CMS. A security vulnerability exists in KiteCMS v1.1.1, which originates from the backend administration module containing arbitrary file reads...
Sourcecodester Baby Care System SQL注入漏洞
Sourcecodester Baby Care System is an application of the Sourcecodester community in the United States. Sourcecodester Baby Care System v1.0 is vulnerable to SQL injection, which originates from /admin.php?id=posts...
Shopware 代码问题漏洞
Shopware is a suite of open source e-commerce software from the German company Shopware. A security vulnerability exists in Shopware that allows an attacker to abuse the Admin SDK functionality on the server to read or update internal resources...
Kentico CMS has an unspecified vulnerability
Kentico is the United States Kentico company's set of ASP.NET-based content management system CMS. A security vulnerability exists in Kentico CMS before 13.0.66, which can be exploited by an attacker with user administrative privileges administrator by default to export any user's user options,...
365Inspect - A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments
Further the state of O365 security by authoring a PowerShell script that automates the security assessment of Microsoft Office 365 environments. Setup 365Inspect requires the administrative PowerShell modules for Microsoft Online, Azure AD We recommend installing the AzureADPreview module, Exchan...
CVE-2022-27475
Cross site scripting XSS vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded...
Webmin Cross-Site Scripting Vulnerability (CNVD-2022-61348)
Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community.A cross-site scripting vulnerability exists in Webmin version 1.973, which stems from the lack of filtering and escaping of user-submitted parameters for the Add User feature. An...
CVE-2022-27194
A vulnerability has been identified in SIMATIC PCS neo Administration Console All versions V3.1 SP1, SINETPLAN All versions, TIA Portal V15, V15.1, V16 and V17. The affected system cannot properly process specially crafted packets sent to port 8888/tcp. A remote attacker could exploit this...
Ecommerce-Website File Upload Vulnerability
Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. v1.1.0 of Ecommerce-Website is vulnerable to a file upload vulnerability, which stems from a lack of file upload restrictions in public/admin/index.php?addproduct The vulnerability is caused...
