2876 matches found
PT-2024-12647
Name of the Vulnerable Software and Affected Versions Automatic Systems SOC FL9600 FirstLane version V06 lego T04E00 Automatic Systems SOC FL9600 FastLine version v.legoT04E00 Description An issue in Automatic Systems SOC FL9600 allows a remote attacker to obtain sensitive information because the...
CVE-2023-37608
An issue in Automatic Systems SOC FL9600 FirstLane V06 legoT04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystems super admin account with astech as its hardcoded password...
404 Solution < 2.35.0 - Admin+ SQLi
Description The plugin does not properly sanitise and escape the orderby parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2023-51461 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...
CVE-2023-48579 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...
PT-2023-7880 · Kaifa Technology · Webitr
Name of the Vulnerable Software and Affected Versions: Kaifa Technology WebITR affected versions not specified Description: The issue is related to the use of a hard-coded encryption key in the WebITR online attendance system. This allows an unauthenticated remote attacker to generate a valid tok...
PT-2023-32772 · Unknown · Codeastro Pos/Inventory Management System
Name of the Vulnerable Software and Affected Versions: CodeAstro POS and Inventory Management System version 1.0 Description: A vulnerability has been found in the system, allowing for improper access controls. The issue is related to the manipulation of the account type argument with the input...
CVE-2023-41789 Unauthenticated Admin Account Takeover Via XSS
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pandora FMS on all allows Cross-Site Scripting XSS. This vulnerability allows an attacker to perform cookie hijacking and log in as that user without the need for credentials. This issue affects...
CVE-2023-4677 Unauthenticated Admin Account Takeover Via Cron Log File Backups
Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...
Cross site request forgery (csrf)
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki installation. Among other things, this allow...
VulnCheck KEV: CVE-2010-0219
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service...
Exploit for Improper Authorization in Splunk
CVE-2023-32707 An improved POC exploit based on the reported C...
CVE-2023-47629: Improper Privilege Management
DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the defau...
The vulnerability of the GLPI system’s request, incident, and asset inventory management processes, related to the improper elimination of special elements used in SQL commands, allows a hacker to gain access to the administrator account.
The vulnerability of the GLPI system for requests, incidents, and inventory management is related to the improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow a malicious actor to gain control of the administrator’s account remotely...
Penglead 2.0 SQL Injection
Title: penglead-2.0 SQLi-Bypass Authentication Author: nu11secur1ty Date: 11/10/2023 Vendor: https://www.mayurik.com/ Software: https://www.mayurik.com/source-code/P2760/lead-management-system-in-php-free-download Reference: https://portswigger.net/web-security/sql-injection Description: The id...
Word Balloon < 4.20.3 - Avatar Removal via CSRF
Description The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link. Make a logged in admin open...
Penglead 2.0 SQL injection Bypass Authentication Vulnerability
Title: penglead-2.0 SQLi-Bypass Authentication Author: nu11secur1ty Vendor: https://www.mayurik.com/ Software: https://www.mayurik.com/source-code/P2760/lead-management-system-in-php-free-download Reference: https://portswigger.net/web-security/sql-injection Description: The id parameter is...
Exploit for Improper Input Validation in Atlassian Confluence_Data_Center
Confluence Vulnerability - CVE-2023-22515 :notebook: Int...
Security Bulletin: IBM Storage Ceph is vulnerable to authentication bypass by spoofing in Grafana (CVE-2022-35957)
Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-35957 Vulnerability Details CVEID: CVE-2022-35957 DESCRIPTION: Grafana could allow a remote authenticated attacker to gain elevated privileges on the system. By sending a specially...
CVE-2023-22518
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perfo...