482 matches found
CVE-2021-40850
CVE-2021-40850 affects TCMAN GIM. It describes a SQL injection vulnerability in multiple web service methods under /PC/WebService.asmx. The CVSS metrics indicate a critical impact (CVSS v3.1: 9.8, NETWORK, LOW complexity, NONE privileges) with high impact on confidentiality, integrity and availab...
CVE-2021-40851
TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information...
The vulnerability of the AADI GeoView Webservice, a software tool for meteorological observations, lies in the lack of protection for the SQL query structure, allowing attackers to execute arbitrary SQL commands.
The vulnerability of the AADI GeoView Webservice software for meteorological observations lies in the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...
PT-2021-22980
Name of the Vulnerable Software and Affected Versions TCMAN GIM affected versions not specified Description The issue concerns a SQL injection vulnerability within several webservice methods in the /PC/WebService.asmx endpoint. This vulnerability could potentially allow an attacker to inject...
Tcman Gim SQL注入漏洞
Tcman Gim is a facility management software from Tcman Spain designed for use on mobile devices. TCMAN GIM suffers from a SQL injection vulnerability that can be exploited via the "/PC/WebService.asmx" page...
CVE-2021-41063
SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands...
CVE-2021-41063
SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands...
Sql injection
SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands...
CVE-2021-41063
The CVE-2021-41063 issue affects the Aanderaa GeoView Webservice (AADI GeoView Webservice) prior to version 2.1.3. The vulnerability is an SQL injection that could allow an unauthenticated attacker to execute arbitrary commands against the GeoView database server. Public sources consistently iden...
CVE-2021-41063: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands...
PT-2021-5343
Name of the Vulnerable Software and Affected Versions Aanderaa GeoView Webservice versions prior to 2.1.3 Description The issue is related to a lack of protection against SQL query structure attacks, which can be exploited by a remote attacker to execute arbitrary SQL commands. This allows...
Johnson Controls exacqVision Web Service Information Disclosure (JCI-PSA-2021-16)
Binary data exacqVisionwebservicecve-2021-27664.nbin...
PT-2022-27161 · Otrs +2 · Otrs +3
Name of the Vulnerable Software and Affected Versions: OTRS versions 7.0.1 through 7.0.40 Patch 1 OTRS versions 8.0.1 through 8.0.28 Patch 1 OTRS Community Edition versions 6.0.1 through 6.0.34 Description: The issue is related to an Improper Input Validation vulnerability that allows SQL Injecti...
Exploit for CVE-2018-2894
Weblogic CVE-2018-2894 CVE-2018-2894 0x01 前言 Oracle 7月更新中，修复了Weblogic Web Service Test Page中一处任意文件上传漏洞，Web Service Test Page 在“生产模式”下默认不开启，所以该漏洞有一定限制， 利用该漏洞，可以上传任意jsp文件，进而获取服务器权限。 0x02 漏洞环境 Ubuntu 16.04 https://github.com/vulhub/vulhub/blob/master/weblogic/CVE-2018-2894/ 执行如下命令，启动weblogic 12.2.1....
CVE-2020-12606
An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xpcmdshell stored...
SAP Unauthenticated WebService User Creation
This module leverages an unauthenticated web service to submit a job which will create a user with a specified role. The job involves running a wizard. After the necessary action is taken, the job is canceled to avoid unnecessary system changes. Module Options msf use...
QRadar Community Edition 7.3.1.6 Server Side Request Forgery Vulnerability
QRadar Community Edition version 7.3.1.6 has an issue where the RssFeedItem class of the QRadar web application is used to fetch and parse RSS feeds. No validation is performed on the user-supplied RSS feed URL. Due to the lack of URL validation whitelisting, it is possible for authenticated...
Buffer Overflow Vulnerability in BeckHoff CX9020
The CX9020 is a PLC generated by BeckHoff with a Webservice for remote configuration of the PLC, through which the user can configure the PLC with a browser. The BeckHoff CX9020 suffers from a buffer overflow vulnerability that can be exploited by an attacker to crash the service or possibly...