CVE-2022-35582

CVE-2022-35582 pertains to Penta Security WAPPLES (versions 4.0., 5.0.0. , 5.0.12.*) with an Incorrect Access Control flaw: the OS includes a built-in non-privileged user named ‘penta’ with a predefined password, whose existence and credentials are not documented. This enables potential unauthori...

Penta Security Systems WAPPLES 安全漏洞

Penta Security Systems WAPPLES is a logical Web application firewall from Penta Security Systems, India. A security vulnerability in Penta Security Systems WAPPLES v6.0 r3 version 4.10-hotfix1, which originates from an arbitrary file download vulnerability in the downloadAction function, allows a...

PT-2022-20686 · Penta Security Systems Inc · Wapples

Name of the Vulnerable Software and Affected Versions: Penta Security Systems Inc WAPPLES version 6.0 r3 4.10-hotfix1 Description: The issue allows attackers to escalate privileges via overwriting files using SUID flagged executables. Recommendations: For Penta Security Systems Inc WAPPLES versio...

PT-2022-22909 · Penta Security Systems Inc · Wapples

Name of the Vulnerable Software and Affected Versions: Penta Security Systems Inc WAPPLES versions 4.0. through 5.0.12. Description: The operating system that WAPPLES runs on has a built-in non-privileged user penta with a predefined password. The password for this user, as well as its existence,...

Penta Security Systems WAPPLES 信任管理问题漏洞

Penta Security Systems WAPPLES is a logical Web application firewall from Penta Security Systems, India. A security vulnerability exists in Penta Security Systems WAPPLES v6.0 r3 version 4.10-hotfix1, which originated from a vulnerability that allows an attacker to elevate privileges by overwriti...

PT-2022-20687 · Penta Security Systems Inc · Wapples

Name of the Vulnerable Software and Affected Versions: Penta Security Systems Inc WAPPLES version 6.0 r3 4.10-hotfix1 Description: An arbitrary file download issue exists in the downloadAction function, allowing attackers to download arbitrary files via a crafted POST request. Recommendations: Fo...

penta-trading.nl Improper Access Control vulnerability OBB-2438853

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SQL Injection Vulnerability in Type Parameters of Penta Digital Campus System

Penta Digital Campus System is using the technology platform of .NET+SqlServer. A SQL injection vulnerability exists in the /Student/xsxk/MessageView.aspx page of the Penda Digital Campus System. The lack of filtering of the 'type' parameter allows an attacker to exploit the vulnerability to obta...

SQL Injection Vulnerability in type=Detail&FileId Parameter of Penta Digital Campus System

Penta Digital Campus System is using the technology platform of .NET+SqlServer. A SQL injection vulnerability exists in the /BG/GRBG/FileManage/FileUPload.aspx page of Pangda Digital Campus System. The lack of filtering of the 'id' parameter allows an attacker to exploit the vulnerability to obta...

SQL Injection Vulnerability in the Parameter txtUsername in the Login.aspx Page of Penta Software Education Management System

Pangda software education management system is .net development for vocational education WEB teaching management system. There is a SQL injection vulnerability in this product, the vulnerability URL is: http://target/NewPage/Login.aspx The vulnerability parameter is txtUsername and the type is PO...