114 matches found
Zucchetti Axess CLOKI Access Control 1.64 CSRF Disable Access Control
Summary CLOKI is the pre-installed application on our terminals that provides simple to use access control management and attendance monitoring using any browser IE, Chrome, Firefox, etc.. It is suited for anyone looking for a stand-alone Access Control and Attendance Monitoring system where the...
WinWaste.NET 1.0.6183.16475 - Privilege Escalation due Incorrect Access Control
Exploit Title: WinWaste.NET 1.0.6183.16475 - Privilege Escalation due Incorrect Access Control Date: 2021-07-01 Author: Andrea Intilangelo Vendor Homepage: http://nica.it - http://winwastenet.com Version: 1.0.6183.16475 Tested on: Windows 10 Pro x64 - 20H2 and 21H1 CVE: CVE-2021-34110 WinWaste.NE...
WinWaste.NET 1.0.6183.16475 Local Privilege Escalation
Exploit Title: WinWaste.NET - Privilege Escalation due Incorrect Access Control Date: 2021-07-01 Author: Andrea Intilangelo Vendor Homepage: http://nica.it - http://winwastenet.com Version: 1.0.6183.16475 Tested on: Windows 10 Pro x64 - 20H2 and 21H1 CVE: CVE-2021-34110 WinWaste.NET version...
WinWaste.NET 1.0.6183.16475 Local Privilege Escalation Vulnerability
WinWaste.NET version 1.0.6183.16475 allows a local unprivileged user to replace the executable with a malicious file that will be executed with LocalSystem privileges. Exploit Title: WinWaste.NET - Privilege Escalation due Incorrect Access Control Author: Andrea Intilangelo Vendor Homepage:...
Zucchetti InfoBusiness Code Execution Vulnerability
Zucchetti InfoBusiness is a business intelligence solution that uses multiple data to generate reports to measure company trends. A code injection vulnerability exists in Zucchetti InfoBusiness 4.4.1 and earlier versions. The vulnerability stems from improper validation of the "Title" field in th...
Zucchetti InfoBusiness Code Execution Vulnerability (CNVD-2019-39372)
Zucchetti InfoBusiness is a business intelligence solution that uses multiple data to generate reports to measure company trends. A code execution vulnerability exists in Zucchetti InfoBusiness 4.4.1 and earlier versions. An attacker can exploit this vulnerability to achieve code execution by...
Zucchetti InfoBusiness Cross-Site Request Forgery Vulnerability
Zucchetti InfoBusiness is a business intelligence solution that uses multiple data to generate reports to measure company trends. A cross-site request forgery vulnerability exists in Zucchetti InfoBusiness 4.4.1 and earlier versions. An attacker can exploit this vulnerability to upload arbitrary...
Zucchetti InfoBusiness Cross-Site Scripting Vulnerability
Zucchetti InfoBusiness is a business intelligence solution that uses multiple data to generate reports to measure company trends. A reflected cross-site scripting vulnerability exists in Zucchetti InfoBusiness 4.4.1 and earlier versions. The vulnerability stems from the failure of the browsing...
CVE-2019-18207
In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Title field in the InfoBusiness Web Component. The payload will be triggered every time a user browses the reports page...
CVE-2019-18207
In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Title field in the InfoBusiness Web Component. The payload will be triggered every time a user browses the reports page...
CVE-2019-18206
A cross-site request forgery CSRF vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload...
CVE-2019-18205
Multiple Reflected Cross-site Scripting XSS vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input encoded in base64. This also applies to the search functionality for the searchKey parameter...
CVE-2019-18204
Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution...
CVE-2019-18205
Multiple Reflected Cross-site Scripting XSS vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input encoded in base64. This also applies to the search functionality for the searchKey parameter...
CVE-2019-18206
A cross-site request forgery CSRF vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload...
CVE-2019-18204
Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution...
Design/Logic Flaw
Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution...
Cross site scripting
Multiple Reflected Cross-site Scripting XSS vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input encoded in base64. This also applies to the search functionality for the searchKey parameter...
Input validation
In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Title field in the InfoBusiness Web Component. The payload will be triggered every time a user browses the reports page...