ROS-20240916-01

A vulnerability in the Webmin hosting control panel is related to incorrect permissions and privileges. Exploitation of the vulnerability could allow an attacker acting remotely to bypass implemented security restrictions. security...

CVE-2024-8866

A vulnerability was found in AutoCMS 5.4. It has been classified as problematic. This affects an unknown part of the file /admin/robot.php. The manipulation of the argument sidebar leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the...

CVE-2020-24061

Cross Site Scripting XSS Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and steal cookies via a crafted script...

CVE-2020-24061

Cross Site Scripting XSS Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and steal cookies via a crafted script...

CVE-2020-24061

Cross Site Scripting XSS Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and steal cookies via a crafted script...

KASDA KW5515 安全漏洞

The KASDA KW5515 is a wireless router from KASDA. A security vulnerability exists in the KASDA KW5515 version 4.3.1.0, which originates from a cross-site scripting vulnerability in the Firewall menu in the control panel, allowing an attacker to execute arbitrary code and steal cookies via special...

Craft CMS vulnerable to stored XSS in breadcrumb list and title fields

Summary Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input. Details 1. In the /admin/categories page, category title isn't sanitized and triggered xss. 2. In the category edit page under the /admin/categories/, category title in breadcrumb list isn't...

GHSA-28H4-788G-RH42 Craft CMS vulnerable to stored XSS in breadcrumb list and title fields

Summary Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input. Details 1. In the /admin/categories page, category title isn't sanitized and triggered xss. 2. In the category edit page under the /admin/categories/, category title in breadcrumb list isn't...

VDA 2402 LTSR Features are not shown as installed when you attempt to change the VDA installation

You may not see the below features selected or installed after you attempt to change or modify the VDA installation from Control panel Use Windows Remote Assistance Use Real-Time Audio Transport Use Screen Sharing Is this VDA installed on VM in the Cloud...

File Management System 1.0 Insecure Direct Object Reference

============================================================================================================================================= | Title : File Management System 1.0 IDOR Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits...

CVE-2024-34650

Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Edge panel...

CVE-2024-34650

Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Edge panel...

CVE-2024-34650

Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Edge panel...

CVE-2024-34650

CVE-2024-34650 affects Samsung CocktailbarService with an improper authorization issue that enables local attackers to access privileged Edge Panel APIs. Affected: CocktailbarService prior to SMR Sep-2024 Release 1. Impact is limited to local access; no remote vector stated. Remediation: upgrade ...

CVE-2024-34650

Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Edge panel...

PT-2024-26070 · Unknown · Cocktailbarservice

Name of the Vulnerable Software and Affected Versions: CocktailbarService versions prior to SMR Sep-2024 Release 1 Description: The issue is related to incorrect authorization in CocktailbarService, allowing local attackers to access privileged APIs related to the Edge panel. This could potential...

vBulletin Password Collector via nodeid SQL Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'vBulletin Password Collector via nodeid SQL Injection', 'Description' = %q This module exploits a SQL injection vulnerability found in vBulletin ...

Improper Authorization

getkirby/cms is vulnerable to Improper Authorization. The vulnerability is due to the insufficient permission checks in the language settings. An attacker with Panel access can manipulate language definitions by exploiting these missing checks...

Kirby has insufficient permission checks in the language settings

TL;DR This vulnerability affects all Kirby sites with enabled languages option that might have potential attackers in the group of authenticated Panel users. If you have disabled the languages and/or api option and don't call any methods in your code that cause a write access to languages languag...

GHSA-JM9M-RQR3-WFMH Kirby has insufficient permission checks in the language settings

TL;DR This vulnerability affects all Kirby sites with enabled languages option that might have potential attackers in the group of authenticated Panel users. If you have disabled the languages and/or api option and don't call any methods in your code that cause a write access to languages languag...