CVE-2021-29697

IBM Cloud Pak for Security CP4S 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive information through HTTP requests that could be used in further attacks against the system...

Panasonic Sanyo CCTV Network Camera 2.03-0x CSRF Disable Authentication / Change Password

Summary SANYO network camera and network optional board with the latest H.264 compression technology provide the optimum surveillance applications with high quality real time moving image at low bandwidth. Simultaneous stream of H.264 and JPEG data and also COAX video out to provide flexible...

Cross-Site Request Forgery (CSRF) in pimcore/pimcore

✍️ Description Your application have not any CSRF protection and also You set the SameSite attribute to Lax, this means if you want to alter some data with GET HTTP requests, then your site should be vulnerable to CSRF attacks with no doubt. First you run this Html payload and then you should see...

Novus Management System Cross-Site Scripting Vulnerability

NOVUS Novus Management System NMS is a management system from NOVUS. Its user interface consists of modular panels that users can adapt to specific systems and operator needs.A cross-site scripting vulnerability exists in Novus Management System version 1.51.2 and earlier. A remote, unauthenticat...

PT-2021-7155

Name of the Vulnerable Software and Affected Versions Oracle Access Manager version 11.1.2.3.0 Description The issue exists due to insufficient input validation in the Rest interfaces for Access Mgr component of Oracle Access Manager. This can be exploited by a remote attacker using specially...

PT-2021-7200

Name of the Vulnerable Software and Affected Versions Hyperion Essbase Administration Services versions 11.1.2.4 through 21.2 Description The issue exists due to insufficient input validation in the EAS Console component of Oracle Hyperion Essbase Administration Services. This allows a remote...

CVE-2021-34821

Cross Site Scripting XSS vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remote, unauthenticated attacker may be able to exploit the issue by sending malicious HTTP requests to non-existing URIs. The value of the URL...

D-LINK DIR-3040 Information Disclosure Vulnerability (CNVD-2021-53338)

The D-LINK DIR-3040 is a router from D-Link, a Taiwan-based company that provides connectivity to the Internet.The D-LINK DIR-3040 is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to send HTTP requests resulting in the disclosure of sensitive...

Cross-Site Request Forgery (CSRF) in seriawei/zkeacms

✍️ Description ZKEACMS is vulnerable to Cross-site request forgery. The app has no mechanism against CSRF in all HTTP requests. 🕵️‍♂️ Proof of Concept Sample: Add products to the shopping cart. HTML content: HTML setTimeout = form.submit , 2000; 1. Save the above content into an HTML file. 2. With...

IBM Security Access Manager Log Information Disclosure Vulnerability

IBM Security Access Manager is a product for information security management applications from IBM, USA. The product enables access management control through integrated devices for web, mobile and cloud computing. IBM Security Access Manager Docker A log information disclosure vulnerability exis...

Advantech R-SeeNet File Inclusion Vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet suffers from a file inclusion vulnerability, which stems from the failure ...

CVE-2021-20498

IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID: 197972...

CVE-2021-20498

IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID: 197972...

Advantech R-SeeNet security vulnerabilities

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet suffers from a file inclusion vulnerability, which stems from the failure ...

FortiMail Command Injection Vulnerability

Fortinet FortiMail is a set of e-mail security gateway products of the U.S. Fita Fortinet. The product provides e-mail security and data protection features. A security vulnerability exists in the FortiMail management interface before 6.4.4, which can be exploited by an attacker to execute...

CVE-2021-20498: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID: 197972...

SAP NetWeaver AS for Java Denial of Service Vulnerability

SAP NetWeaver AS is an SAP web application server from SAP, a German company. SAP NetWeaver AS for Java has a denial of service vulnerability that can be exploited by an attacker to cause a denial of service by sending multiple Http requests with different method types...

CVE-2021-33687

SAP NetWeaver AS JAVA Enterprise Portal, versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attacker can use this in conjunction with other attacks such as XSS to steal this information...

Denial of service

SAP NetWeaver AS for Java Http Service Monitoring Filter, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to deni...

CVE-2021-33687

SAP NetWeaver AS JAVA Enterprise Portal, versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attacker can use this in conjunction with other attacks such as XSS to steal this information...