CVE-2021-45106

A vulnerability has been identified in SICAM TOOLBOX II All versions. Affected applications use a circumventable access control within a database service. This could allow an attacker to access the database...

CVE-2021-45106

A vulnerability has been identified in SICAM TOOLBOX II All versions. Affected applications use a circumventable access control within a database service. This could allow an attacker to access the database...

Improper access control

A vulnerability has been identified in SICAM TOOLBOX II All versions. Affected applications use a circumventable access control within a database service. This could allow an attacker to access the database...

CVE-2021-45106

Siemens SICAM TOOLBOX II is affected by CVE-2021-45106 due to a circumventable access control in the database service, enabling attacker access to the database. The vulnerability is described as use of hard-coded credentials (CWE-798) across all versions of SICAM TOOLBOX II. Per ICS/CISA advisori...

CVE-2021-45106: Use of Hard-coded Credentials

A vulnerability has been identified in SICAM TOOLBOX II All versions. Affected applications use a circumventable access control within a database service. This could allow an attacker to access the database...

Gopherus

This is an analysis of the provided repository, specifically focusing on the Gopherus tool. Classification: The Gopherus tool is a proof-of-concept exploit for various vulnerabilities, including SSRF Server-Side Request Forgery and RCE Remote Code Execution. Primary Vulnerability: The primary...

CVE-2020-16860

A remote code execution vulnerability exists in Microsoft Dynamics 365 on-premises when the server fails to properly sanitize web requests to an affected Dynamics server. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SQL service account. A...

OPF OpenProject Activities API SQL Injection (CVE-2019-11600)

A SQL injection vulnerability has been reported in OpenProject. This vulnerability can be exploited by sending crafted HTTP requests to a vulnerable application. Successful exploitation could lead to arbitrary SQL statement execution in the security context of database service...

Zoho ManageEngine OpManager SQL Injection (CVE-2018-17823; CVE-2018-17283)

An SQL injection vulnerability exists in ManageEngine. This vulnerability is due to insufficient validation of the name parameter when processing requests sent. Successful exploitation could lead to arbitrary SQL code execution in the security context of database service...

Zoho ManageEngine OpManager SQL Injection (CVE-2018-9088)

An SQL injection vulnerability exists in ManageEngine. This vulnerability is due to insufficient validation of the parameter in Java class. Successful exploitation could lead to arbitrary code execution in the security context of database service...

Arbitrary File Read Vulnerability in NetEase Cloud RDS Service

NetEase Cloud RDS is a stable, reliable and elastic scalable online relational database service. An arbitrary file read vulnerability exists in the NetEase Cloud RDS service, which can be exploited by an attacker to read arbitrary files...

Arbitrary File Read Vulnerability in AWS RDS Service

Amazon RDS Service is an RDS service from Amazon that enables you to easily set up, operate, and scale relational databases in the cloud. An arbitrary file read vulnerability exists in AWS RDS Service, which can be exploited by an attacker to read arbitrary files...

Oracle TNS Listener VSNNUM Version Remote Information Disclosure

It was possible to extract the version number of the remote Oracle TNS Transparent Network Substrate listener remotely by sending an unauthenticated request to the TNS listener service operating on this port. This information could aid an attacker. Note that the version of the TNS listener does n...

Microsoft Windows 10: Enable computer and user accounts to be trusted for delegation

This policy setting determines which users can set the Trusted for Delegation setting on a user or computer object. Security account delegation provides the ability to connect to multiple servers, and each server change retains the authentication credentials of the original client. Delegation of...

NEW: Vulnerability and Assessment Scanning for Your AWS Cloud Databases

Scuba is a free and easy-to-use tool that uncovers hidden security risks. Scuba is frequently updated with content from Imperva’s Defense Center researchers. With Scuba you can: Scan enterprise databases for vulnerabilities and misconfigurations Identify risks to your databases Get recommendation...

SolarWinds Log and Event Manager < 6.3.1 Hotfix 4 Multiple Vulnerabilities

SolarWinds Log and Event Manager LEM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2017-6633

Name of the Vulnerable Software and Affected Versions Openstack DBaaS aka Trove versions prior to 2015.1.0 aka Kilo Description The issue allows local users to write to configuration files via a symlink attack on a temporary file. This is due to vulnerabilities in several functions, including wri...

Completely remove WSUS 3.0 approach-vulnerability warning-the black bar safety net

Upgrade the domain controller or demote a domain controller, wsus services usually fail, only by hand to completely remove wsus3. 0 and then re-install, the following is the result of several attempts later summed up the detailed operation of the steps of: 1, the...

MySQL Zero-length Scrambled String Crafted Packet Authentication Bypass

A bug in the version of MySQL running on the remote host allows a remote attacker to bypass the password authentication mechanism using a specially crafted packet with a zero-length scramble buff string. An attacker with knowledge of an existing account defined to the affected service can leverag...

Firebird Default Credentials (Firebird Protocol)

It is possible to connect to the remote database service using default credentials. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...