9451 matches found
CVE-2021-24774
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues...
Download Monitor < 4.4.5 - Admin+ SQL Injection
The plugin does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue PoC There need to be at least one log for the payload to trigger...
ImpulsiveDLLHijack - C# Based Tool Which Automates The Process Of Discovering And Exploiting DLL Hijacks In Target Binaries
C based tool which automates the process of discovering and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during RedTeam Operations to evade EDR's. 1. Methodological Approach : The tool basically acts on automating following stages performed for...
Cross-Site Request Forgery (CSRF) in namelessmc/nameless
Description More instances of CSRF Proof of Concept /index.php?route=/panel/users/reports/&action=close&id=1 /index.php?route=/panel/users/reports/&action=open&id=1 /index.php?route=/panel/core/emails/errors/&do=delete&id=2 /index.php?route=/panel/core/emails/errors/&do=purge...
Draytek VigorConnect Information Disclosure Vulnerability
VigorConnect is the local network management software for DrayTek devices.An information disclosure vulnerability exists in Draytek VigorConnect version 1.6.0-B3. An attacker could exploit this vulnerability to export system logs...
CVE-2021-20129
An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs...
CVE-2021-20129
An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs...
Information disclosure
An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs...
CVE-2021-20129
An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs...
CVE-2021-20129
CVE-2021-20129 affects Draytek VigorConnect 1.6.0-B3. An unauthenticated attacker can export system logs via network exposure (information disclosure). Other connected sources also describe a local file inclusion risk in related endpoints (WebServlet/DownloadFileServlet) on the same version, enab...
Draytek VigorConnect 日志信息泄露漏洞
VigorConnect is the local network management software for DrayTek devices.An information disclosure vulnerability exists in Draytek VigorConnect version 1.6.0-B3. An attacker could exploit this vulnerability to export system logs...
WordPress 404 to 301 plugin <= 3.0.8 - Cross-Site Request Forgery (CSRF) vulnerability leading to Logs Deletion
Cross-Site Request Forgery CSRF vulnerability leading to Logs Deletion discovered by apple502j in WordPress 404 to 301 plugin versions = 3.0.8. Solution Update the WordPress 404 to 301 plugin to the latest available version at least 3.0.9...
404 to 301 < 3.0.9 - Logs Deletion via CSRF
Description The plugin does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack PoC https://example.com/wp-admin/admin.php?page=jj4t3-logs=bulkclean...
404 to 301 < 3.0.9 - Logs Deletion via CSRF
Description The plugin does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack https://example.com/wp-admin/admin.php?page=jj4t3-logs&action=bulkclean...
Samsung SMR 安全漏洞
Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in versions prior to Samsung SMR Oct-2021 Release 1, which stems from information leakage in the Widevine TA logs, allowing an attacker to exploit t...
WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs plugin <= 1.7.8 - Log Deletion via Cross-Site Request Forgery (CSRF) vulnerability
Log Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by apple502j in WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs plugin versions = 1.7.8. Solution Update the WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs plugin to the latest...
Samsung SMR 信息泄露漏洞
Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in versions prior to Samsung SMR Oct-2021 Release 1, which stems from an information disclosure in ipcdump, which allows an attacker to exploit the...
CVE-2021-35503
Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs...