CVE-2018-17429

/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...

Cross site request forgery (csrf)

/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...

CVE-2018-17429

/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...

CVE-2018-17429

CVE-2018-17429 refers to a CSRF vulnerability in JTBC v3.0(C) where requests to /console/account/manage.php?type=action&action=add can be forged to add an administrator account. A remote attacker can exploit this CSRF to elevate privileges by creating a new admin account. The reports in CNVD/othe...

Design/Logic Flaw

Eloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the p2p/api/ or p2p/lib/ or p2p/images/ URI...

CVE-2019-9552

CVE-2019-9552 affects Eloan V3.0 (through 2018-09-20). The vulnerability allows remote attackers to list files by directly requesting the p2p/api/, p2p/lib/, or p2p/images/ URIs. The documents do not provide a root-cause analysis, affected software versions beyond the stated release window, or re...

CVE-2019-9552

Eloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the p2p/api/ or p2p/lib/ or p2p/images/ URI...

CVE-2019-9040

CVE-2019-9040 affects S-CMS PHP v3.0, reporting a CSRF flaw that allows adding a new admin user via the admin/ajax.php?type=admin&action=add URI (related to CVE-2018-19332). The connected Red Hat/PRION/NVD entries confirm the same vector: CSRF enabling admin user creation. The root cause is impro...

PDF Signer 3.0 - Server-Side Template Injection leading to Remote Command Execution (via Cross-Site Request Forgery Cookie)

PDF Signer 3.0 - Server-Side Template Injection leading to Remote Command Execution via Cross-Site Request Forgery Cookie Exploit Title: PDF Signer v3.0 - SSTI to RCE via CSRF Cookie Dork: N/A Date: 2019-01-28 Exploit Author: dd [email protected] Vendor Homepage:...

PDF Signer 3.0 - SSTI to RCE via CSRF Cookie Vulnerability

Exploit for php platform in category web applications Exploit Title: PDF Signer v3.0 - SSTI to RCE via CSRF Cookie Exploit Author: dd email protected Vendor Homepage: https://codecanyon.net/user/simcycreative Software Link:...

Sql injection

SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php Oid parameter...

CVE-2019-6805

SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php Oid parameter...

CVE-2019-6805

CVE-2019-6805 is a SQL injection vulnerability in S-CMS v3.0, exploitable via the alipay/alipayapi.php O_id parameter. The issue allows partial to full disclosure/impact on confidentiality, integrity, and availability (per CVSS 2.0/3.0 vectors; base scores 7.5 and 9.8 respectively). The provided ...

Sql injection

S-CMS V3.0 has SQL injection via the Sid parameter, as demonstrated by the /1/?type=productinfo&Sid=140 URI...

CVE-2018-20018

S-CMS V3.0 has SQL injection via the Sid parameter, as demonstrated by the /1/?type=productinfo&Sid=140 URI...

CVE-2018-20018

S-CMS V3.0 has SQL injection via the Sid parameter, as demonstrated by the /1/?type=productinfo&Sid=140 URI...

Security Bulletin: IBM Security Key Lifecycle Manager Uses Hard-coded Credentials (CVE-2018-1742)

Summary IBMSecurity Key Lifecycle Manager contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Vulnerability Details CVEID: CVE-2018-1742...

CVE-2018-16431

admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account...

Cross site request forgery (csrf)

admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account...

CVE-2018-16431

CVE-2018-16431 affects YFCMF v3.0. The vulnerability is a CSRF flaw in the admin/admin/adminsave.html endpoint that allows an attacker to add an administrator account. TheRoot cause involves insufficient CSRF protection on an admin-facing URL, enabling unauthorized privileged action without user ...