PT-2023-6395 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: The issue concerns an Exposure of Sensitive Information vulnerability existing in an undisclosed BIG-IP TMOS shell tmsh command. This vulnerability may allow an authenticated attacker with...

WordPress Plugin Post View Count Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists i...

CVE-2023-39854: Server-Side Request Forgery (SSRF)

The web interface of ATX Ucrypt through 3.5 allows authenticated users or attackers using default credentials for the admin, master, or user account to include files via a URL in the /hydra/view/getccurl url parameter. There can be resultant SSRF...

PT-2023-27137 · Unknown · Atx Ucrypt

Name of the Vulnerable Software and Affected Versions: ATX Ucrypt versions 3.5 and earlier Description: The web interface of ATX Ucrypt allows authenticated users, or attackers using default credentials for the admin, master, or user account, to include files via a URL in the "/hydra/view/get cc...

ATX Ucrypt Code Issue Vulnerability

ATX Ucrypt is a series of media distribution gateways over IP Q2IP from ATX America, Inc. It is designed to provide reliable and secure HD or SD programming to hotels or other commercial venues. A security vulnerability exists in ATX Ucrypt 3.5 and prior versions, which stems from the presence of...

D-View 8 showUser Privilege Escalation

The vulnerability of the “showUser” method in the D-View 8 network device management platform is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

D-View 8 Network Device Management Platform Auth Bypass

The vulnerability of the InstallApplication class in the D-View 8 network device management platform is related to the use of pre-installed credentials. Exploiting this vulnerability allows a remote attacker to bypass authentication processes...

Online Pizza Ordering System SQL Injection Vulnerability

Online Pizza Ordering System is an online pizza ordering system. Online Pizza Ordering System suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in the back-end database via scripting...

PT-2023-5692 · D Link · D-Link D-View

Name of the Vulnerable Software and Affected Versions: D-Link D-View affected versions not specified Description: This issue allows remote attackers to bypass authentication on affected installations of D-Link D-View. The specific flaw exists within the InstallApplication class, which contains a...

PT-2023-5887 · D Link · D-Link D-View

Name of the Vulnerable Software and Affected Versions: D-Link D-View affected versions not specified Description: This issue allows remote attackers to create a denial-of-service condition on affected installations of D-Link D-View. The specific flaw exists within the shutdown coreserver action,...

PT-2023-5693 · D Link · D-Link D-View

Name of the Vulnerable Software and Affected Versions: D-Link D-View affected versions not specified Description: The issue is related to the showUsers method and is caused by inadequate authorization procedures. This allows remote attackers to escalate their privileges on affected installations...

PT-2023-6102 · D Link · D-Link D-View

Name of the Vulnerable Software and Affected Versions: D-Link D-View versions affected versions not specified Description: The issue is related to the addDv7Probe function and involves improper restriction of XML External Entity XXE references. This allows remote attackers to disclose sensitive...

PT-2023-6106 · D Link · D-Link D-View

Name of the Vulnerable Software and Affected Versions: D-Link D-View affected versions not specified Description: The vulnerability resides within the coreservice action script action of the D-Link D-View platform. It involves the exposure of a dangerous function, allowing remote attackers to...

(0Day) D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the showUsers method. The issue results from the lack of proper authorization before accessing a...

(0Day) D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the addDv7Probe function. Due to the improper restriction of XML External Entity X...

(0Day) D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the InstallApplication class. The class contains a hard-coded password for the remotely...

(0Day) D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the coreserviceactionscript action. The issue results from the exposure of a dangerous...

(0Day) D-Link D-View shutdown_coreserver Missing Authentication Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the shutdowncoreserver action. The issue results from the lack of...

WordPress Post View Count Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Post View Count Type Plugin Vulnerable versions = 2.0 Fixed in 2.0.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-44996 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9ca3df3cf077 Credits Rio Darmawan Required...

ASB-A-274058082

In androidviewInputDevicecreate of androidviewInputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...