5951 matches found
FIN8 Hackers Return With More Powerful Version of BADHATCH PoS Malware
Threat actors known for keeping a low profile do so by ceasing operations for prolonged periods in between to evade attracting any attention as well as constantly refining their toolsets to fly below the radar of many detection technologies. One such group is FIN8, a financially motivated threat...
Netgear NETGEAR JGS516PE 跨站请求伪造漏洞
The Netgear NETGEAR JGS516PE is a switch from Netgear, Inc. The NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 suffers from a cross-site request forgery vulnerability that stems from a CSRF protection mechanism implemented in the web management panel that can be bypassed by omitting the CSRF token parameter...
NewStart CGSL CORE 5.04 / MAIN 5.04 : openwsman Vulnerability (NS-SA-2021-0029)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openwsman packages installed that are affected by a vulnerability: - Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in processconnection when parsing specially crafted HTTP requests. A remote...
NewStart CGSL MAIN 6.02 : openwsman Vulnerability (NS-SA-2021-0084)
The remote NewStart CGSL host, running version MAIN 6.02, has openwsman packages installed that are affected by a vulnerability: - Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in processconnection when parsing specially crafted HTTP requests. A remote,...
Emerson Smart Wireless Gateway 1420 4.6.59 Privilege Escalation Vulnerability
Title: Privilege Escalation Product: Emerson Smart Wireless Gateway Vendor Homepage: http://emerson.com Vulnerable Version: 1420 4.6.59 CVE Number: CVE-2020-19417 Authors: Harsha Bhat Anish Mitra and Unmesh Guragol Timeline: 2019-08-02 Disclosed to the vendor 2019-08-22 Vendor confirmed that the...
Zoho ManageEngine ADSelfService Plus跨站脚本漏洞
ZOHO ManageEngine ADSelfService Plus, an integrated self-service password management and single sign-on solution for Active Directory and cloud applications from ZOHO, is vulnerable to cross-site scripting. A cross-site scripting vulnerability exists in Zoho ManageEngine ADSelfService Plus, which...
Emerson Smart Wireless Gateway 1420 4.6.59 Privilege Escalation
Title: Privilege Escalation Product: Emerson Smart Wireless Gateway Vendor Homepage: http://emerson.com Vulnerable Version: 1420 4.6.59 CVE Number: CVE-2020-19417 Authors: Harsha Bhat Anish Mitra and Unmesh Guragol Timeline: 2019-08-02 Disclosed to the vendor 2019-08-22 Vendor confirmed that the...
Cisco Content Security Management Appliance Information Disclosure (cisco-sa-esa-sma-info-disclo-VOu2GHbZ)
An information disclosure vulnerability exists in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance SMA due to confidential information being included in HTTP requests that are exchanged between the user and the device. An authenticated,...
Cisco Content Security Management Appliance Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance SMA could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because confidential information is bei...
PT-2021-2255 · Cisco · Cisco Sd-Wan Vmanage
Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a directory traversal...
Microsoft Exchange Server Request Forgery Vulnerability
Exchange is a messaging and collaboration system that is a suite of e-mail service components from Microsoft. Microsoft Exchange Server request forgery vulnerability can be exploited by an attacker to be able to send arbitrary HTTP requests and authenticate with Exchange Server...
CVE-2021-21322 Prefix escape
fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...
FortiOS Path Traversal Credential Gatherer
Fortinet FortiOS versions 5.4.6 to 5.4.12, 5.6.3 to 5.6.7 and 6.0.0 to 6.0.4 are vulnerable to a path traversal vulnerability within the SSL VPN web portal which allows unauthenticated attackers to download FortiOS system files through specially crafted HTTP requests. This module exploits this...
The vulnerability of the vSphere Client plugin for managing VMware vCenter Server allows a attacker to send requests on behalf of the targeted server.
The vulnerability of the vSphere Client plugin for managing VMware vCenter Server lies in insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to send requests on behalf of the targeted server by sending specially crafted HTTP requests...
HaE - BurpSuite Highlighter And Extractor
HaE is used to highlight HTTP requests and extract information from HTTP response messages or request messages. Read Chinese simplified version READMEzh. Public Rules Website: https://gh0st.cn/HaE/ Introduction HaE is used to highlight HTTP requests and extract information from HTTP response...
Friendica Server-Side Request Forgery Vulnerability
Friendica is an application for the German Friendica community. Provides decentralized social networking. A server-side request forgery vulnerability exists in Friendica version 2021.01. The vulnerability stems from allowing DNS lookups and HTTP requests for arbitrary domains via parseurl?binurl=...
Server side request forgery (ssrf)
A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...
Nagios XI OS Command Injection Vulnerability
Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. An OS command injection vulnerability exists in /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php in Nagios XI...
Nagios XI OS Command Injection Vulnerability (CNVD-2021-11071)
Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. An OS command injection vulnerability exists in /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php in Nagio...
