7898 matches found
PT-2023-32637 · Unknown · Quarkus Cache Runtime
Name of the Vulnerable Software and Affected Versions: Quarkus Cache Runtime affected versions not specified Description: A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the...
WBCE CMS 1.6.1 Shell Upload Vulnerability
Exploit Title: WBCE CMS Version : 1.6.1 Remote Command Execution Exploit Author: tmrswrr Vendor Homepage: https://wbce-cms.org/ Software Link: https://github.com/WBCE/WBCECMS/archive/refs/tags/1.6.1.zip Version: 1.6.1 Tested on: https://www.softaculous.com/apps/cms/WBCECMS POC: 1 Login with admin...
CVE-2023-35138
A command injection vulnerability in the “showzysyncservercontents” function of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST request...
CVE-2023-35138
A command injection vulnerability in the “showzysyncservercontents” function of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST request...
Command injection
A command injection vulnerability in the “showzysyncservercontents” function of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST request...
CVE-2023-35138
A command injection vulnerability in the “showzysyncservercontents” function of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST request...
Zyxel NAS326 Security Vulnerability
Zyxel NAS326 is a cloud storage NAS from China Heqin Zyxel. A security vulnerability exists in Zyxel NAS326 V5.21AAZF.14C0 and NAS542 V5.21ABAG.11C0 and earlier versions, which stems from the presence of a command injection vulnerability that could allow an unauthenticated attacker to execute...
The vulnerability of the OpenCMS content management system lies in the improper limitation of XML links to external objects, which allows attackers to execute arbitrary code by sending a specially crafted POST request.
The vulnerability of the OpenCMS content management system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted POST request remotely...
VulnCheck KEV: CVE-2023-33831
A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...
VulnCheck KEV: CVE-2021-35327
A vulnerability in TOTOLINK A720R A720RFirmware v4.1.5cu.470B20200911 allows attackers to start the Telnet service, then login with the default credentials via a crafted POST request...
Rocky Linux 9 : curl (RLSA-2023:0333)
The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:0333 advisory. - When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option...
Potix ZK Framework AuUploader Remote File Disclosure (CVE-2022-36537)
The version of Potix ZK Framework detected on the remote host is prior to 8.6.4.2, 9.0.1.3, 9.5.1.4, 9.6.0.2, or 9.6.2. If is, therefore, affected by a remote file disclosure vulnerability: - ZK Framework allows attackers to access sensitive information via a crafted POST request sent to the...
The vulnerability of Sielco PolyEco1000 digital FM transmitter’s microprogramming software, related to access control deficiencies, allows a intruder to gain access to the device with administrator rights.
The vulnerability of Sielco PolyEco1000 digital FM transmitter’s microprogramming software is related to lack of access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the device with administrator privileges by using a POST request...
CVE-2023-46863
Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request...
CVE-2023-46864
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request...
CVE-2007-10003
The CVE-2007-10003 entry concerns The Hackers Diet Plugin for WordPress (up to version 0.9.6b). The vulnerability affects the ajax_blurb.php component of the HTTP POST Request Handler, where manipulation of the user parameter leads to SQL injection. Exploitation is remote possible. Remediation is...
CVE-2023-46864
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request...
Peppermint Security Vulnerabilities
Peppermint is an open source ticket management system from Peppermint Labs. A security vulnerability exists in Peppermint Ticket Management versions prior to 0.2.4. A remote attacker could exploit this vulnerability by passing /api/v1/users/file/download?filepath=. /... /.../ POST request to read...
