6797 matches found
Design/Logic Flaw
Lifesize Express ls ex24.7.10 2000 14 devices allow XSS via the interface/interface.php brand parameter...
CVE-2018-17981
Lifesize Express ls ex24.7.10 2000 14 devices allow XSS via the interface/interface.php brand parameter...
CVE-2018-17981
CVE-2018-17981 affects Lifesize Express devices running ls ex2_4.7.10 (2000 (14) devices). The vulnerability is a cross-site scripting (XSS) flaw exploitable via the interface/interface.php brand parameter, leading to potential script execution in a user’s browser. Root cause is an XSS in the bra...
CVE-2018-17981: Improper Neutralization of Input During Web Page Generation
Lifesize Express ls ex24.7.10 2000 14 devices allow XSS via the interface/interface.php brand parameter...
PT-2020-8630
Name of the Vulnerable Software and Affected Versions: Lifesize Express ls ex2 version 4.7.10 Description: The issue allows for XSS via the brand parameter in the "interface/interface.php" endpoint. This affects approximately 2000 devices. Recommendations: For version 4.7.10, avoid using the bran...
CVE-2018-16847
An out-of-bounds heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvmecmbops routines in a nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in denial of service or, potentially, run arbitrary code wi...
Authentication Bypass
Overview All versions of express-laravel-passport are vulnerable to an Authentication Bypass. The package fails to properly validate JWTs, allowing attackers to send HTTP requests impersonating other users. Recommendation Upgrade to version 2.0.5 or later. References - HackerOne Report - GitHub...
express-elect.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1063379 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Exploit for Code Injection in Mongo-Express_Project Mongo-Express
CVE-2019-10758 mongo-express远程代码执行，反弹shell代码如下： POST BODY 1:...
MongoDB mongo-express Remote Code Execution (CVE-2019-10758)
A remote code execution vulnerability exists in MongoDB mongo-express. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
bem-register (>=1.0.0, <=1.0.5), itstep_server (0.0.1) +4 more potentially affected by CVE-2019-10758 via mongo-express (>=0.19.0, <=0.53.0)
mongo-express NPM version =0.19.0, =1.0.0, =0.1.1, =1.0.0, =1.5.0, =1.6.1 Source cves: CVE-2019-10758 Source advisory: OSV:GHSA-H47J-HC6X-H3QQ...
Remote Code Execution Vulnerability in NPM mongo-express
Impact Remote code execution on the host machine by any authenticated user. Proof Of Concept Launching mongo-express on a Mac, pasting the following into the "create index" field will pop open the Mac calculator: javascript this.constructor.constructor"return...
GHSA-H47J-HC6X-H3QQ Remote Code Execution Vulnerability in NPM mongo-express
Impact Remote code execution on the host machine by any authenticated user. Proof Of Concept Launching mongo-express on a Mac, pasting the following into the "create index" field will pop open the Mac calculator: javascript this.constructor.constructor"return...
MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure Vulnerability
Exploit for hardware platform in category web applications Exploit: MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure Author: LiquidWorm Vendor: Emmanuel Product web page: https://github.com/empierre/MyDomoAtHome https://www.domoticz.com/wiki/ImperiHome...
MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure
Exploit: MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure Date: 2019-12-30 Author: LiquidWorm Vendor: Emmanuel Product web page: https://github.com/empierre/MyDomoAtHome https://www.domoticz.com/wiki/ImperiHome https://docs.imperihome.com/app/iss Affected version: 0.2.40...
PT-2019-5322
Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of Cisco UCS Director and Cisco UCS...
PT-2019-5341
Name of the Vulnerable Software and Affected Versions Cisco UCS Director and Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of the affected devices, which may allow a remote attacker to...
PT-2019-5339
Name of the Vulnerable Software and Affected Versions Cisco UCS Director affected versions not specified Cisco UCS Director Express for Big Data affected versions not specified Description The issue is related to insufficient input validation in the REST API of Cisco UCS Director and Cisco UCS...
Exploit for Code Injection in Mongo-Express_Project Mongo-Express
CVE-2019-10758 PoC Setup docker run -p 27017:27017 -...
The vulnerability of the Cisco Unity Express aut secretary, related to the refusal to accept measures for eliminating special elements used in the operating system’s command, allows a hacker to elevate their privileges and execute arbitrary code.
The vulnerability of the Cisco Unity Express autochanger lies in its inability to accept measures to neutralize special elements. Exploiting this vulnerability may allow an attacker to enhance their privileges and execute arbitrary code...