5654 matches found
Crafter CMS security vulnerability
Crafter CMS is an open source content management system CMS for digital experience applications.A security vulnerability exists in Crafter CMS, which stems from the possibility that an authenticated administrator could override the system configuration file. An attacker could exploit this...
CVE-2021-23261
Authenticated administrators may override the system configuration file and cause a denial of service...
CVE-2021-3981
A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in...
SuiteCRM 7.11.18 Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SuiteCRM Log File Remote Code Execution', 'Description' = %q This module exploits an input validation error on the log file extension parameter. ...
ChopChop - ChopChop Is A CLI To Help Developers Scanning Endpoints And Identifying Exposition Of Sensitive Services/Files/Folders
ChopChop is a command-line tool for dynamic application security testing on web applications, initially written by the Michelin CERT. Its goal is to scan several endpoints and identify exposition of services/files/folders through the webroot. Checks/Signatures are declared in a config file by...
Siemens SIMATIC RTLS Locating Manager Sensitive Information Explicit Storage Vulnerability
SIMATIC RTLS Locating Manager is used to configure, operate, and maintain SIMATIC RTLS units, a real-time wireless positioning system that provides positioning solutions.A security vulnerability exists in Siemens SIMATIC RTLS Locating Manager, which stems from the fact that the application writes...
Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File Clearing
The plugin does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder Click the "Log Monitor" available under Error Log Viewer menu item. Choose a log file to clear. Intercept the reques...
PT-2021-6900
Name of the Vulnerable Software and Affected Versions Eurotherm by Schneider Electric GUIcon version 2.0 Build 683.003 and prior Description A CWE-787: Out-of-bounds Write issue exists that could cause arbitrary code execution when a malicious .gd1 configuration file is loaded into the GUIcon too...
Schneider Electric Eurotherm by Schneider Electric GUIcon buffer error vulnerability
Schneider Electric Eurotherm by Schneider Electric GUIcon is a suite of graphical user interface programming software from Schneider Electric France. Schneider Electric Eurotherm by Schneider Electric GUIcon suffers from a buffer error vulnerability that originates when a malicious .gd1...
Schneider Electric Eurotherm by Schneider Electric GUIcon buffer error vulnerability
Schneider Electric Eurotherm by Schneider Electric GUIcon is a graphical user interface programming software from Schneider Electric France. Schneider Electric GUIcon suffers from a buffer overflow vulnerability that originates when a malicious .gd1 configuration file is loaded into the GUIcon...
PT-2021-9136
Name of the Vulnerable Software and Affected Versions SIMATIC RTLS Locating Manager versions prior to V2.12 Description A issue has been identified where the application does not properly handle the import of large configuration files. This could allow a local attacker to import a specially craft...
PT-2021-6899
Name of the Vulnerable Software and Affected Versions Eurotherm by Schneider Electric GUIcon version 2.0 Build 683.003 and prior Description A Use After Free vulnerability exists that could cause arbitrary code execution when a malicious .gd1 configuration file is loaded into the GUIcon tool. Thi...
CVE-2021-26786
An issue was discoverered in in customercentric-selling-poland PlayTube, allows authenticated attackers to execute arbitrary code via the purchace code to the config.php...
PT-2021-7241
Name of the Vulnerable Software and Affected Versions Cisco AppDynamics Controller Software affected versions not specified Description A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attacker to access a...
[SECURITY] Fedora 35 Update: watchdog-5.16-2.fc35
The watchdog program can be used as a powerful software watchdog daemon or may be alternately used with a hardware watchdog device such as the IPMI hardware watchdog driver interface to a resident Baseboard Management Controller BMC. watchdog periodically writes to /dev/watchdog; the interval...
CVE-2021-41078
Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file...
[SECURITY] Fedora 34 Update: watchdog-5.16-2.fc34
The watchdog program can be used as a powerful software watchdog daemon or may be alternately used with a hardware watchdog device such as the IPMI hardware watchdog driver interface to a resident Baseboard Management Controller BMC. watchdog periodically writes to /dev/watchdog; the interval...
[SECURITY] Fedora 33 Update: watchdog-5.16-2.fc33
The watchdog program can be used as a powerful software watchdog daemon or may be alternately used with a hardware watchdog device such as the IPMI hardware watchdog driver interface to a resident Baseboard Management Controller BMC. watchdog periodically writes to /dev/watchdog; the interval...
CVE-2021-21744
ZTE MF971R product has a configuration file control vulnerability. An attacker could use this vulnerability to modify the configuration parameters of the device, causing some security functions of the device to be disabled...
CVE-2021-21744
ZTE MF971R product has a configuration file control vulnerability. An attacker could use this vulnerability to modify the configuration parameters of the device, causing some security functions of the device to be disabled...