139 matches found
CVE-2020-25760
Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input validation on the 'rid' parameter. An attacker can append SQL queries to the input to extract sensitive information from the database...
CVE-2020-25760: Improper Neutralization of Special Elements used in an SQL Command
Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input validation on the 'rid' parameter. An attacker can append SQL queries to the input to extract sensitive information from the database...
PT-2020-16186
Name of the Vulnerable Software and Affected Versions Projectworlds Visitor Management System version 1.0 Description The issue allows for SQL Injection due to a lack of input validation on the rid parameter in the front.php file. This enables an attacker to append SQL queries to the input,...
CVE-2020-12259
rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php...
CVE-2020-12259
rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php...
CVE-2020-12259: Improper Neutralization of Input During Web Page Generation
rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php...
Access to COM+ role-based security is denied in Windows Server 2012 R2
Access to COM+ role-based security is denied in Windows Server 2012 R2 This article describes an issue that occurs when the GetEffectiveRightsFromAcl function is used in Windows Server 2012 R2. You can fix this issue by using the update in this article. Before you install this update, see the...
MSSQLi-DUET - SQL Injection Script For MSSQL That Extracts Domain Users From An Active Directory Environment Based On RID Bruteforcing
SQL injection script for MSSQL that extracts domain users from an Active Directory environment based on RID bruteforcing. Supports various forms of WAF bypass techniques through the implementation of SQLmap tamper functions. Additional tamper functions can be incorporated by the user depending on...
Persistence – RID Hijacking
Windows operating systems use the RID Relative Identifier to differentiate groups and user accounts. It is part of the Security Identifier SID and every time… Continue reading - Persistence - RID Hijacking...
CVE-2018-16988
An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass account takeover exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situation where the attacker knows that the victim has started a...
CVE-2018-16988: Weak Password Recovery Mechanism for Forgotten Password
An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass account takeover exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situation where the attacker knows that the victim has started a...
Trivial Post-Intrusion Attack Exploits Windows RID
An novel post-intrusion attack technique allows hackers to hijack a Windows system component called RID, allowing the adversaries to assign administrative privileges to “guest” and other low-level accounts. The technique is simple and does not require a lot of sophistication, security researcher...
icebreaker - Gets Plaintext Active Directory Credentials If You'Re On The Internal Network
Break the ice with that cute Active Directory environment over there. Automates network attacks against Active Directory to deliver you piping hot plaintext credentials when you're inside the network but outside of the Active Directory environment. Performs 5 different network attacks for plainte...
Automate Network Attacks Against Active Directory: icebreaker
Break the ice with that cute Active Directory environment over there. Automates network attacks against Active Directory to deliver you piping hot plaintext credentials when you’re inside the network but outside of the Active Directory environment. Performs 5 different network attacks for plainte...
NITC营销系统 v4.0 index.php 参数rid SQL注入
No description provided by source...
Why a War Studies PhD?
When I begin receiving multiple questions on a topic, it's a signal that I should write a blog post. Several of you have asked me about my experience as a PhD candidate in the King's College London Department of War Studies. In this post I will try to answer your questions by explaining how I got...
CVE-2014-8267
Cross-site scripting XSS vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter...
CVE-2014-8267
Cross-site scripting XSS vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter...
CVE-2014-8267: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter...