IBM Aspera Cargo and IBM Aspera Connect Code Execution Vulnerabilities

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. A code execution vulnerability exists in IBM Aspera Cargo and IBM Aspera Connect that originates from a boundary check error and can be exploited by an attack...

Osprey Pump Controller 1.0.1 - Authentication Bypass Credentials Modification

!/usr/bin/env python Exploit Title: Osprey Pump Controller v1.0.1 - Authentication Bypass Credentials Modification Exploit Author: LiquidWorm Vendor: ProPump and Controls, Inc. Product web page: https://www.propumpservice.com | https://www.pumpstationparts.com Affected version: Software Build ID...

CVE-2023-26857

An arbitrary file upload vulnerability in /admin/ajax.php?action=saveuploads of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2023-1846

A vulnerability has been found in SourceCodester Online Payroll System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/deductionrow.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has bee...

Buffer overflow

IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248616...

Security Bulletin: Vulnerabilities in SSL and TLS protocols affects SAN Volume Controller and Storwize Family (CVE-2011-3389)

Summary Security Bulletin: Vulnerabilities in SSL and TLS protocols affects SAN Volume Controller and Storwize Family CVE-2011-3389 Vulnerability Details Security Bulletin --- Summary --- SSL and TLS vulnerabilities were disclosed in September 2011. This vulnerability has been referred to as the...

The vulnerability of the Zabbix universal monitoring system, related to the lack of measures taken to protect the website structure, allows attackers to compromise data integrity.

The vulnerability of the Zabbix universal monitoring system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

CVE-2023-26959

Phpgurukul Park Ticketing Management System 1.0 is vulnerable to SQL Injection via the User Name parameter...

PT-2023-8343 · Apple · Macos Monterey +3

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 macOS Big Sur versions prior to 11.7.5 macOS Monterey versions prior to 12.6.4 Description: An access issue was addressed with additional sandbox restrictions. This issue may allow an app to access user-sensitive...

The vulnerability of the System component of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability of the System component of the Android operating system exists due to insufficient checking of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Air Cargo Management System SQL注入漏洞

Air Cargo Management System is an air cargo management system. A SQL injection vulnerability exists in SourceCodester Air Cargo Management System version 1.0, which stems from a problem in the file admin/transactions/updatestatus.php, where manipulation of the parameter id can lead to sql injecti...

SQL Injection

moodle/moodle is vulnerable to SQL Injection attacks. The vulnerability is due to improper sanitization located in the sort parameter of the enrolgetmycourses function in enrollib.php which allows a malicious attacker to inject and execute arbitrary SQL queries on the system when fetching courses...

CVE-2023-25617 OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server)

SAP Business Object Adaptive Job Server - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the...

Altenergy Power System Control Software 操作系统命令注入漏洞

Altenergy Power System Control Software is microinverter control software from Altenergy Power System. A security vulnerability exists in AlAltenergy Power System Control Software version C1.2.5, which originates from an operating system command injection vulnerability...

Online Food Ordering System 跨站请求伪造漏洞

Online Food Ordering System is an online food ordering system by Carlo Montero, an individual developer. A security vulnerability exists in Online Food Ordering System version 1.0, which stems from a cross-site request forgery CSRF vulnerability. The vulnerability can be exploited by an attacker ...

IDOR Vulnerability Allow Low-Level User Logout Everyone Includes Admin

Description IDOR vulnerability allow low level user to log out everyone in the system by changing the user ID. Proof of Concept Step 1: Login in as admin Step 2: Go to user and add an user. Set role to Default. Step 3: Login as the new user. Step 4: Logout the user GET...

PT-2023-1864 · Moxa · Moxa Uc Series

Name of the Vulnerable Software and Affected Versions: Moxa UC Series devices affected versions not specified Description: The issue allows an attacker with physical access to the device to initiate a restart, gain access to the BIOS, and alter command line options to access the terminal. From th...

HYBRID Software Cloudflow 路径遍历漏洞

HYBRID Software Cloudflow is a modular production workflow suite for print document processing, asset management, soft proofing and workflow automation from HYBRID Software. A security vulnerability exists in HYBRID Software Cloudflow that stems from a local file inclusion vulnerability. An...

SUSE CVE-2011-0469

Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011...

SUSE CVE-2011-1344

Use-after-free vulnerability in WebKit, as used in Apple Safari before 5.0.5; iOS before 4.3.2 for iPhone, iPod, and iPad; iOS before 4.2.7 for iPhone 4 CDMA; and possibly other products allows remote attackers to execute arbitrary code by adding children to a WBR tag and then removing the tag,...