The vulnerability of the relay_cgi.cgi script implementation in the microprogramming software for Dingtian DT-R002’s relay devices allows a hacker to bypass security restrictions and gain full control over the device.

The vulnerability of the relaycgi.cgi script implementation in Dingtian DT-R002 microprogramming software relates to exploiting the capture-replay technique to bypass authentication procedures. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions and gain ful...

Planet Enterprises Planet eStream SQL注入漏洞

Planet Enterprises Planet eStream is a very simple and secure tool from Planet Enterprises, Inc. It makes video more accessible to students and staff at all levels of education. A SQL injection vulnerability exists in Planet Enterprises Planet eStream versions prior to 6.72.10.07, which was...

PT-2022-24501 · Vmware · Vmware Hyperic Server

Name of the Vulnerable Software and Affected Versions: VMware Hyperic Server version 5.8.6 Description: A security filter misconfiguration exists, enabling a malicious party to bypass some authentication requirements when issuing requests to the server. This issue only affects products that are n...

CVE-2022-38119

UPSMON Pro login function has insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and get administrator privilege to access, control system or disrupt service...

Path traversal

UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication and access arbitrary system files...

PT-2022-26576 · Unknown · Comserver Series

Name of the Vulnerable Software and Affected Versions: ComServer Series affected versions not specified Description: The issue allows an unauthenticated remote attacker to bypass authentication and log in without knowledge of the password by crafting a modified HTTP GET Request. Recommendations: ...

PT-2022-24691 · Unknown · Agentflow Bpm

Name of the Vulnerable Software and Affected Versions: Agentflow BPM affected versions not specified Description: The Agentflow BPM file download function has a path traversal issue. This allows an unauthenticated remote attacker to bypass authentication and download arbitrary system files...

AliveCor KardiaMobile 授权问题漏洞

AliveCor KardiaMobile is a personal electrocardiograph from AliveCor USA. AliveCor KardiaMobile suffers from a security vulnerability that stems from susceptibility to an intent to manipulate vulnerability that allows an attacker to bypass application authentication and view or change information...

Delta Industrial Automation DIAEnergie Use Of Hard-Coded Credentials Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Delta Industrial Automation DIAEnergie. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of requests to the web service. The issue results...

CVE-2022-39300

node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the...

Passport-SAML 数据伪造问题漏洞

Passport-SAML is the SAML 2.0 authentication provider for Passport, the Node.js authentication library. Passport-SAML suffers from a data forgery issue vulnerability that stems from the fact that a remote attacker can use passport-saml to bypass SAML authentication on a website...

PT-2022-5797 · Aruba · Aruba Edgeconnect Enterprise Orchestrator

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise Orchestrator versions 9.1.2.40051 and below Aruba EdgeConnect Enterprise Orchestrator versions 9.0.7.40108 and below Aruba EdgeConnect Enterprise Orchestrator versions 8.10.23.40009 and below Aruba EdgeConnect...

Security Updates for Microsoft Office Products (October 2022)

The Microsoft Office Products are missing security updates. It is, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if descripti...

Vulnerability fixed in FortiGate and FortiProxy

Fortinet has fixed a vulnerability in FortiGate and FortiProxy. An unauthenticated malicious party could potentially exploit the vulnerability potentially exploit it to bypass authentication on the management interface and thus perform actions perform actions normally reserved for authenticated...

CVE-2022-39033

Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete...

Path traversal

Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication, access restricted paths and download system files...

Cisco Duo 授权问题漏洞

Cisco Duo is a fully managed solution from Cisco, Inc. Provides secure access to your applications and data. Cisco Duo suffers from an authorization issue vulnerability that stems from a failure to properly match the smart card's designated user to an authenticated user, which can be exploited by...

Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite

Explotación Activa Sobre Zimbra CVE-2022-37042 RCE Unauthent...

Security Bulletin: Vulnerabilities in libcurl affect IBM Spectrum Protect Plus SQL, File Indexing, and Windows Host agents

Summary Multiple vulnerabilities in libcurl affect the IBM Spectrum Protect Plus SQL, File Indexing, and Windows Host agents. These vulnerabilities include obtaining sensitive information, man-in-the-middle attacks, denial of service, and bypassing of security restrictions. Vulnerability Details...

Authentication flaw

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...