8139 matches found
CVE-2024-38446
NATO NCI ANET 3.4.1 mishandles report ownership. A user can create a report and, despite the restrictions imposed by the UI, change the author of that report to an arbitrary user without their consent or knowledge via a modified UUID in a POST request...
CVE-2024-6807
CVE-2024-6807 affects SourceCodester Student Study Center Desk Management System 1.0. The vulnerability exists in the HTTP POST handler at /sscdms/classes/Users.php?f=save, where manipulating the arguments firstname, middlename, lastname, or username triggers a cross-site scripting (XSS) flaw. Th...
PT-2024-28006 · Nato · Nato Nci Anet
Name of the Vulnerable Software and Affected Versions: NATO NCI ANET version 3.4.1 Description: The issue concerns mishandling of report ownership. A user can create a report and change its author to any arbitrary user without their consent or knowledge. This is achieved by modifying the UUID in ...
CVE-2024-38446
NATO NCI ANET 3.4.1 mishandles report ownership. A user can create a report and, despite the restrictions imposed by the UI, change the author of that report to an arbitrary user without their consent or knowledge via a modified UUID in a POST request...
CVE-2024-38446
CVE-2024-38446 concerns NATO NCI ANET 3.4.1. The vulnerability allows an attacker to create a report and, by altering a UUID in a POST request, change the report author to an arbitrary user without their consent. This is a logic/authorization issue where report ownership is mishandled. Affected c...
PT-2024-37878 · Sourcecodester · Sourcecodester Student Study Center Desk Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Student Study Center Desk Management System version 1.0 Description: A vulnerability was found in the system, classified as problematic, affecting some unknown functionality of the file /sscdms/classes/Users.php?f=save of the...
Geoserver Unauthenticated Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Geoserver unauthenticated Remote Code Execution', 'Description' = %q GeoServer is an open-source software server written in Java that provides th...
CVE-2024-39181
Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a buffer overflow via the ApCliSsid parameter in thegenerateconfrouter function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...
CVE-2023-3290 A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0
A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...
CVE-2023-3286 A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0
A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user secretary in the system. This results in unauthorized data manipulation...
CVE-2024-39181
Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a buffer overflow via the ApCliSsid parameter in thegenerateconfrouter function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...
The vulnerability of the formQosManageDouble_user() function in the Tenda W9 wireless access point software allows a intruder to execute arbitrary code or cause a service failure.
The vulnerability of the formQosManageDoubleuser function in the Tenda W9 wireless access point software is related to buffer overflow based on a stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause a service failure by sending a specially crafted POST...
CVE-2024-37769
Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...
CVE-2024-37769
Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...
CVE-2024-37769
CVE-2024-37769 affects 14Finger v1.1 due to insecure permissions that allow a normal user to escalate to Administrator via a crafted POST request. Exploitation details beyond the described crafted POST are not provided in the connected documents. The impact is privilege escalation; no remediation...
CVE-2024-37769
Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...
CVE-2024-37769
Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...
14Finger Security Vulnerability
14Finger is a full-featured Web fingerprint recognition and sharing platform by b1ackc4t individual developers. A security vulnerability exists in version 1.1 of 14Finger, which stems from a vulnerability that allows an attacker to elevate privileges from a regular user to an administrator via a...
PT-2024-27740 · 14Finger · 14Finger
Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: Insecure permissions in the software allow attackers to escalate privileges from a normal user to Administrator via a crafted POST request. This issue can be exploited by sending a manipulated POST request to...
