Apache Solr Server-Side Request Forgery (CVE-2021-27905)

A sever-side request forgery vulnerability exists in Apache Solr. The vulnerability is due to a lack of validation on the subdomain parameter in HTTP requests. Successful exploitation of this vulnerability could allow an unauthenticated attacker to make a request to any internal and external serv...

Server Side Request Forgery (SSRF)

zendesk/zendeskapiclientphp is vulnerable to server side request forgery SSRF. The vulnerability exists as it does not validate provided Zendesk subdomain to be a valid subdomain in the function getAuthUrl and getAccessToken, allowing an attacker to send arbitrary HTTP requests on behalf of the...

Apache Tapestry ContextAssetRequestHandler Incorrect Authorization Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apache Tapestry. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ContextAssetRequestHandler class. The issue results from the improper...

Cacti 1.2.12 - 'filter' SQL Injection

Exploit Title: Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution Date: 04/28/2021 Exploit Author: Leonardo Paiva Vendor Homepage: https://www.cacti.net/ Software Link: https://www.cacti.net/downloads/cacti-1.2.12.tar.gz Version: 1.2.12 Tested on: Ubuntu 20.04 CVE : CVE-2020-14295...

Cross site request forgery (csrf)

HomeAutomation 3.3.2 is affected by Cross Site Request Forgery CSRF. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges i...

CVE-2020-21989

HomeAutomation 3.3.2 is affected by Cross Site Request Forgery CSRF. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges i...

Server-side request forgery in extension "Yoast SEO for TYPO3" (yoast_seo)

The extension fails to restrict analyzed URLs to domains managed by the current TYPO3 website. A logged in TYPO3 backend user can use the vulnerability to make HTTP requests to arbitrary domains including the webserver itself or other internally managed resources...

CVE-2020-21989: Cross-Site Request Forgery (CSRF)

HomeAutomation 3.3.2 is affected by Cross Site Request Forgery CSRF. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges i...

Apache Ozone Access Control Vulnerability

Apache Ozone is a scalable, redundant and distributed object store for Hadoop and cloud-native environments. An authorization issue vulnerability exists in Apache Ozone Cluster versions prior to 1.1.0 related to the affected version allowing access to keys and buckets via curl commands or...

Sipwise C5 NGCP CSC - Click2Dial Cross-Site Request Forgery (CSRF)

Exploit Title: Sipwise C5 NGCP CSC - Click2Dial Cross-Site Request Forgery CSRF Date: 13.04.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.sipwise.com Sipwise C5 NGCP CSC CSRF Click2Dial Exploit Vendor: Sipwise GmbH Product web page: https://www.sipwise.com Affected version:...

PT-2021-2841

Name of the Vulnerable Software and Affected Versions: Oracle Enterprise Asset Management versions 12.1.1 through 12.1.3 Oracle Enterprise Asset Management versions 12.2.3 through 12.2.10 Description: The issue is related to errors in the code of the Setup component of Oracle Enterprise Asset...

PT-2021-2842

Name of the Vulnerable Software and Affected Versions: Oracle Financials Common Modules versions 12.1.1 through 12.1.3 Description: The issue is related to errors in the code of the Advanced Global Intercompany component. It can be exploited by a remote attacker using HTTP requests, allowing...

PT-2021-2847

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite component: Process Operations versions 12.1.3 Description: The issue is related to errors in the code of the Process Operations component of Oracle MES for Process Manufacturing in Oracle E-Business Suite. This can be...

PT-2021-2934

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Description The issue is related to errors in the code of the Receipts component of Oracle Receivables in Oracle E-Business Suite. It allows a remote attacker to gain unauthorized access t...

PT-2021-2931

Name of the Vulnerable Software and Affected Versions Oracle iStore versions 12.1.1 through 12.1.3 Description The issue is related to errors in the code of the Shopping Cart component in Oracle iStore, part of the Oracle E-Business Suite. This can be exploited by a remote attacker using HTTP...

PT-2021-2936

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.3 Description The issue is related to errors in the code of the Endeca component in Oracle Purchasing. It allows a remote attacker to gain unauthorized access to the device using HTTP requests. Successful...

PT-2021-2938

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Oracle E-Business Suite versions 12.2.3 through 12.2.10 Description The issue is related to errors in the code of the User Interface component of Oracle Projects in the Oracle E-Business...

PT-2021-2916

Name of the Vulnerable Software and Affected Versions Enterprise Manager for Fusion Middleware versions 11.1.1.9 through 12.2.1.3 Description The issue exists due to insufficient input validation in the FMW Control Plugin component. It allows a remote attacker to gain read access to data, modify...

PT-2021-2846

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.1.1 through 12.1.3 Oracle E-Business Suite versions 12.2.3 through 12.2.10 Description: The issue is related to errors in the code of a subcomponent, specifically the India Localization and Results componen...

PT-2021-2932

Name of the Vulnerable Software and Affected Versions Oracle Subledger Accounting versions 12.1.1 through 12.1.3 Description The issue is related to errors in the code of the Inquiries component of Oracle Subledger Accounting in Oracle E-Business Suite. It allows a remote attacker to gain...