Design/Logic Flaw

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

Path traversal

WMS 3.7 contains a Path Traversal Vulnerability in Device API. An attacker could potentially exploit this vulnerability, to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application...

CVE-2022-34365

WMS 3.7 contains a Path Traversal Vulnerability in Device API. An attacker could potentially exploit this vulnerability, to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application...

Dell Wyse Management Suite 跨站脚本漏洞

Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell, Inc. The product includes centralized Wyse endpoint management, asset tracking and automated device discovery. context of a vulnerable Web application and execute malicious HTML or JavaScript code i...

CVE-2022-2634 Digi ConnectPort X2D

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

CVE-2022-2634

The CVE-2022-2634 entry maps to Digi ConnectPort X2D Gateway vulnerabilities where the web application lacks device access protections and permissions, allowing an attacker to upload Python files that can be executed. Concrete details from connected sources indicate affected products are Digi Con...

CVE-2022-2634 Digi ConnectPort X2D

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

webdesenvolvimento.com.br Cross Site Scripting vulnerability OBB-2832695

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PAN-OS 10.0 - Remote Code Execution (Authenticated) Exploit

Exploit Title: PAN-OS 10.0 - Remote Code Execution RCE Authenticated Exploit Author: UnD3sc0n0c1d0 Software Link: https://security.paloaltonetworks.com/CVE-2020-2038 Category: Web Application Version: 10.0.1, 9.1.4 and 9.0.10 Tested on: PAN-OS 10.0 - Parrot OS CVE : CVE-2020-2038 Description: An ...

PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: PAN-OS 10.0 - Remote Code Execution RCE Authenticated Date: 2022-08-13 Exploit Author: UnD3sc0n0c1d0 Software Link: https://security.paloaltonetworks.com/CVE-2020-2038 Category: Web Application Version: 10.0.1, 9.1.4 and 9.0.10 Tested on: PAN-OS 10.0 - Parrot OS CVE : CVE-2020-2038...

Login Form Cross-Site Request Forgery

Cross Site Request Forgery CSRF occurs when an user is tricked into clicking on a link which would automatically submit a request without the user's consent. This can be made possible when the request does not include an anti-CSRF token, generated each time the request is visited and passed when...

Blind XPath Injection (differential analysis)

XML Path Language XPath queries are used by web applications for selecting nodes from XML documents. Once selected, the value of these nodes can then be used by the application. A simple example for the use of XML documents is to store user information. As part of the authentication process, the...

Previously created sessions continue being valid after MFA activation [namelessmc.com]

Description 1. Hello Team I found one issue related to your 2FA system on https://namelessmc.com/user/settings/?do=enabletfa&s=2 Vulnerability Type: 1. Improper Access Control - Generic STEP TO REPRODUCE: 1. 1- access the same account on https://namelessmc.com/ in two devices 2. 2- on device 'A' ...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices Cameralyzer versions prior to 3.2.22, 3.3.22, 3.4.22, and 3.5.51, which stems from an imprope...

PT-2022-23636 · Unknown · Cameralyzer

Name of the Vulnerable Software and Affected Versions: Cameralyzer versions prior to 3.2.22 Cameralyzer versions prior to 3.3.22 Cameralyzer versions prior to 3.4.22 Cameralyzer versions prior to 3.5.51 Description: An improper access control issue in the WebApp component of Cameralyzer allows...

CVE-2022-34768

insert HTML / js code inside input how to get to the vulnerable input : Workers worker nickname inject in this input the code...

WordPress SeatReg 1.23.0 Open Redirect

Exploit Title: WordPress Plugin ‘SeatReg’ - Unauthenticated Open Redirect Date: 01-08-2022 Exploit Author: Mariam Tariq - HunterSherlock Vendor Homepage: https://wordpress.org/plugins/seatreg/ Version: 1.23.0 Tested on: Firefox Contact me: [email protected] Description: An Open Redirection...

The vulnerability of the microprogrammed software of Modicon M241 and Modicon M251 control units lies in the insufficient protection of registration data, allowing attackers to intercept login credentials and access the web application.

The vulnerability of the microprogrammed logic controllers Modicon M241 and Modicon M251 is related to insufficient protection for registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to intercept login credentials and gain access to the web application...

WordPress Blog2Social Plugin <= 5.5.0 SQLi Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

Apache Axis <= 1.4 Multiple Vulnerabilities

Apache Axis is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:axis"; if description...