CVE-2024-5009

CVE-2024-5009 PoC para la escalada de privilegios de SetAdminPassword en Progress WhatsUp Gold CVE-2024-5009 Puedes encontrar un análisis de la causa raíz de la vulnerabilidad en mi blog: https://summoning.team/blog/progress-whatsup-gold-privesc-setadminpassword-cve-2024-5009/ Uso python3...

CVE-2024-5009

CVE-2024-5009 : Escalada de Privilegios SetAdminPassword en WhatsUp Gold Herramienta CVEHunter para la detección y explotación de vulnerabilidades para CVE-2024-5009 con rendimiento asíncrono. Instalación git clone https://github.com/th3gokul/CVE-2024-5009.git cd CVE-2024-5009 pip install -r...

CVE-2024-5009 WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability

In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password...

CVE-2024-5009 WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability

In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password...

Progress Software WhatsUp Gold Security Vulnerability

Progress Software WhatsUp Gold is a network monitoring software from Progress Software, Inc. It is used to monitor the entire network infrastructure as well as applications, configurations and network traffic. A security vulnerability exists in Progress Software WhatsUp Gold version 2023.1.3, whi...

CVE-2024-5013: Uncontrolled Resource Consumption

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible...

CVE-2020-26942

An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a setAdminPassword operation request, subsequently setting a new arbitrary password for the admin account...

Cross site request forgery (csrf)

An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a setAdminPassword operation request, subsequently setting a new arbitrary password for the admin account...

CVE-2020-26942: Missing Authentication for Critical Function

An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a setAdminPassword operation request, subsequently setting a new arbitrary password for the admin account...

PT-2024-10803 · Axigen · Axigen Mail Server

Name of the Vulnerable Software and Affected Versions: Axigen Mail Server versions 10.3.x through 10.3.1.26 Axigen Mail Server versions 10.3.2.x through 10.3.2.x Description: An issue in Axigen Mail Server allows unauthenticated attackers to submit a setAdminPassword operation request, setting a...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15868)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the 'updatepw' and 'setAdminPassword' methods in versions of Quest DR Series disk backup software prior to version 4.0.3.1. An attacker can exploit this vulnerability to execute arbitrar...