94 matches found
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives...
CVE-2024-29210
A local privilege escalation LPE vulnerability has been identified in Phish Alert Button for Outlook PAB, specifically within its configuration management functionalities. This vulnerability allows a regular user to modify the application's configuration file to redirect update checks to an...
CVE-2023-5876
Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service...
CVE-2023-26466
A user with non-Admin access can change a configuration file on the client to modify the Server URL...
CVE-2022-39280
dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version...
CVE-2025-2776
SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives...
CVE-2024-22030 Rancher agents can be hijacked by taking over the Rancher Server URL
A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle MITM attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The...
GHSA-H4H5-9833-V2P4 Rancher agents can be hijacked by taking over the Rancher Server URL
Impact A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle MITM attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability...
CVE-2024-39767 Spoofed push notifications from malicious server
Mattermost Mobile Apps versions =2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another server’s diagnostic ID or server URL and have them show up in mobile apps as that...
CrushFTP Directory Traversal
Exploit Title: CrushFTP Directory Traversal Google Dork: N/A Date: 2024-04-30 Exploit Author: Abdualhadi khalifa https://twitter.com/absholily Vendor Homepage: https://www.crushftp.com/ Software Link: https://www.crushftp.com/download/ Version: below 10.7.1 and 11.1.0 as well as legacy 9.x Tested...
CrushFTP < 11.1.0 - Directory Traversal
Exploit Title: CrushFTP Directory Traversal Google Dork: N/A Date: 2024-04-30 Exploit Author: Abdualhadi khalifa https://twitter.com/absholily Vendor Homepage: https://www.crushftp.com/ Software Link: https://www.crushftp.com/download/ Version: below 10.7.1 and 11.1.0 as well as legacy 9.x Tested...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-42013 Vulnerability Scanner This Python script check...
Design/Logic Flaw
Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service...
CVE-2023-5876
Mattermost security issue CVE-2023-5876: a RegExp built from the server URL path is not properly validated, allowing a malicious server-enrolled attacker to cause a Denial of Service. Descriptions across sources attribute this to Mattermost and note vulnerability affects Mattermost versions up to...
Mattermost Security Vulnerabilities
Mattermost is an open source collaboration platform from US-based Mattermost. A security vulnerability exists in Mattermost version 5.5.0 and prior versions, which stems from an inability to properly validate a regular expression constructed based on the path to a server URL, resulting in a denia...
Workspace error "Unable to add account with the given server URL"
After adding Gateway URL on Windows Workspace, we can see below error: -------- Unable to add account with the given server URL. Ensure that it is correct or enter your email address --------...
CVE-2023-26466
A user with non-Admin access can change a configuration file on the client to modify the Server URL...
Default configuration
A user with non-Admin access can change a configuration file on the client to modify the Server URL...
CVE-2023-26466
CVE-2023-26466 concerns Pegasystem PEGA Platform. A user with non-admin privileges can modify a client configuration file to change the Server URL, enabling potential manipulation of where the client talks to. The CVSS-derived impact is rated high across confidentiality, integrity, and availabili...