CVE-2021-33538 WEIDMUELLER: WLAN devices affected by improper access control vulnerability

In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iwwebs account settings functionality. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access ...

CVE-2021-34244

A cross site request forgery CSRF vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or change users' passwords...

Enphase Envoy 信任管理问题漏洞

The Enphase Energy Envoy is a gateway device for connecting smart home devices from Enphase Energy USA. The Enphase Energy Envoy has a trust management issue vulnerability that stems from the installer and Enphase accounts having hard-coded web panel login passwords, which are hard-coded values...

Wire cross-site scripting vulnerability (CNVD-2021-44982)

Wire is a chat software by an individual developer. The program supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos, and its original way of saying hello, PING. A cross-site scripting vulnerability exists in wire-webapp, which can be...

CVE-2021-32683

wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab right click - open in new tab, or copy the URL and paste it in the URL bar, ...

CVE-2021-32683

wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab right click - open in new tab, or copy the URL and paste it in the URL bar, ...

CVE-2021-32683 XSS through createObjectURL

wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab right click - open in new tab, or copy the URL and paste it in the URL bar, ...

PRTG Network Monitor < 22.1.74 CSRF Vulnerability

PRTG Network Monitor is prone to a cross-site request forgery CSRF vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...

CVE-2021-34547

PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation...

CVE-2021-34547

PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation...

Cross site request forgery (csrf)

PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation...

CVE-2021-34547

CVE-2021-34547 affects Paessler PRTG Network Monitor (version 20.1.55.1775) and is a CSRF flaw in the /editsettings endpoint that can lead to unintended user-creation actions. The description explicitly states a cross-site request forgery vulnerability in the web application, enabling an attacker...

CVE-2021-34547

PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation...

SQL Injection in t3/dce

The dce aka Dynamic Content Element extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account...

GHSA-5V5H-4W2G-GXXC SQL Injection in t3/dce

The dce aka Dynamic Content Element extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account...

GHSA-XPXM-PF7G-2534 Cross-site scripting in media2click

The media2click aka 2 Clicks for External Media extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account...

Cross-site scripting in media2click

The media2click aka 2 Clicks for External Media extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account...

Johnson Controls Metasys

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Equipment: Metasys Servers, Engines, and Tools Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could give an authenticated...

CVE-2020-35972

The CVE-2020-35972 entry relates to YzmCMS V5.8 and describes a Cross-Site Request Forgery (CSRF) vulnerability in the endpoint member/member/add.html. The weakness allows an attacker to cause the creation of new member user accounts via CSRF requests, as reported across multiple sources (CNVD/CN...

WordPress WP Prayer 1.6.1 Cross Site Scripting

Exploit Title: WordPress Plugin WP Prayer version 1.6.1 - 'prayermessages' Stored Cross-Site Scripting XSS Authenticated Date: 2021-05-31 Exploit Author: Bastijn Ouwendijk Vendor Homepage: http://goprayer.com/ Software Link: https://wordpress.org/plugins/wp-prayer/ Version: 1.6.1 and earlier Test...