3269 matches found
Apache DolphinScheduler Permission License and Access Control Issues Vulnerability
Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache Foundation. A security vulnerability exists in Apache DolphinScheduler prior to 1.3.2, which allows normal users to override other users' passwords via the API interface...
Win911 Enterprise Security Vulnerability
Win911 Enterprise is a mobile application from Win911 USA that allows information interaction with industrial equipment. A security vulnerability exists in Win-911 Enterprise V4.20.13, which can be exploited by an attacker to override various executable programs, which may result in escalation of...
DEBIAN-CVE-2019-25010
An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when privategettypeid is overridden...
CVE-2020-35370
A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code executionRCE on the...
Prototype Pollution in asaianudeep/deep-override
Description deep-override is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var deepOverride = require"deep-override" const payload = JSON.parse'"proto":"polluted":"Yes! Its Polluted"'; var obj = console.log"Before : " + .polluted; deepOverrideobj,...
Raysync 3.3.3.8 - RCE
Exploit Title: Raysync 3.3.3.8 - RCE Date: 04/10/2020 Exploit Author: XiaoLong Zhu Vendor Homepage: www.raysync.io Version: below 3.3.3.8 Tested on: Linux step1: run RaysyncServer.sh to build a web application on the local environment, set admin password to 123456 , which will be write to manage....
CakePHP 4.0.10 Released
CakePHP 4.0.10 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 4.0.10. This release contains security fixes and is a recommended upgrade for all applications still using 4.0.x. The security fixes address a vulnerability in the CsrfProtectionMiddleware tha...
Systeminformation Operating System Command Injection Vulnerability
systeminformation is an Npm software library for individual developers individual developers to obtain operating system information. A security vulnerability exists in systeminformation version 4.30.2, which can be exploited by an attacker to override properties and functions of an object, leadin...
HadSky Light Forum program has an override access vulnerability
HadSky Light Forum program is a personal original PHP system. A vulnerability exists in the HadSky Light Forum program that can be exploited by an attacker to gain unauthorized access to administrator information...
Schneider Electric Interactive Graphical SCADA System Buffer Error Vulnerability
The Schneider Electric Interactive Graphical SCADA System IGSS is a SCADA Data Acquisition and Supervisory System system for monitoring and controlling industrial processes from Schneider Electric, France. The Interactive Graphical SCADA System suffers from a buffer error vulnerability that stems...
Schneider Electric Schneider Electric Interactive Graphical SCADA System Buffer Error Vulnerability
The Schneider Electric Interactive Graphical SCADA System IGSS is a SCADA Data Acquisition and Supervisory System system for monitoring and controlling industrial processes from Schneider Electric, France. The Interactive Graphical SCADA System suffers from a buffer error vulnerability that stems...
Security Bulletin: Apache Struts (Publicly disclosed vulnerability) affects Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections
Summary Apache Struts is vulnerable to a denial of service, caused by an access permission override when performing a file upload. By sending a specially crafted request, an attacker could exploit this vulnerability to cause subsequent upload actions to fail. Vulnerability Details CVEID:...
Vulnerability in Ecstore of Shanghai Shangpai Network Technology Co.
Ecstore is based on a new generation of "e-commerce solution-driven engine" ECOS development of enterprise-class open source online store system , the system is based on the PHP language and MYSQL database framework for the development of cross-platform open-source program . Ltd. Ecstore has an...
BEESCMS suffers from an override access vulnerability
BEESCMS is a scalable content management system CMS based on PHP and MySQL. BEESCMS suffers from an override access vulnerability. An attacker can exploit the vulnerability to log in to the administrator backend without a password...
Scientific Linux Security Update : firefox on SL7.x x86_64 (20201001)
Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3 CVE-2020-15673 - Mozilla: Integer overflow in nsJPEGEncoder::emptyOutputBuffer CVE-2020-12422 - Mozilla: X-Frame-Options bypass using object or embed tags CVE-2020-15648 - Mozilla: Bypassing iframe sandbox whe...
CVE-2020-15233
Summary: CVE-2020-15233 affects ORY Fosite
PCFCMS has an overstepping vulnerability
PCFCMS is based on the TP6.0 framework as the core development of free + open source enterprise content management system. PCFCMS has an override vulnerability that can be exploited by attackers to obtain sensitive information...
MikroTik RouterOS < 6.46.7, 6.47.x < 6.48beta40, 7.x < 7.1beta3 DoS Vulnerability
MikroTik RouterOS is prone to a denial of service DoS vulnerability in the SMB server. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
