CVE-2021-42562

An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users...

CVE-2021-42562

An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users...

CVE-2021-42562

An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users...

CVE-2022-22111

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged use...

BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting (Unauthenticated) Vulnerability

Exploit Title: BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting XSS Unauthenticated Google Dork: intext:"BeyondTrust" "Redistribution Prohibited" Exploit Author: Malcrove Vendor Homepage: https://www.beyondtrust.com/ Version: v6.0 and earlier versions Summary: Unauthenticated...

BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)

Exploit Title: BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting XSS Unauthenticated Google Dork: intext:"BeyondTrust" "Redistribution Prohibited" Date: 30/12/2021 Exploit Author: Malcrove Vendor Homepage: https://www.beyondtrust.com/ Version: v6.0 and earlier versions Summary:...

DayByDay CRM 授权问题漏洞

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. A security bypass vulnerability exists in DayByDay CRM, which can be exploited by an attacker to change any user's password and gain...

PT-2022-11919 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.0.beta10 Discourse versions prior to 2.7.12 Description: The issue affects Discourse, an open source platform for community discussion, where admin users can trigger a Denial of Service attack via the...

CVE-2021-25981

In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attack...

BeyondTrust Remote Support 6.0 Cross Site Scripting

Exploit Title: BeyondTrust Remote Support - Reflected Cross-Site Scripting XSS Unauthenticated Google Dork: intext:"BeyondTrust" "Redistribution Prohibited" Date: 30/12/2021 Exploit Author: Malcrove Vendor Homepage: https://www.beyondtrust.com/ Version: v6.0 and earlier versions CVE: CVE-2021-315...

CVE-2021-20132

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router i.e., as the "admin" user, UID 0...

Authentication flaw

Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authentication can be bypassed and a user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page...

D-Link DIR-2640 信任管理问题漏洞

D-Link DIR-2640 is a high-powered Wi-Fi router from D-Link, a Taiwan-based company. D-Link DIR-2640 Quagga 1.11B02 and previous versions are vulnerable to a trust management issue, which stems from the use of default hard-coded credentials for the service, and can be exploited by remote attackers...

CVE-2021-25991

CVE-2021-25991 (Ifme) : Affected software: Ifme, versions v5.0.0–v7.32. Root cause: improper access control. Impact: admins can ban themselves, resulting in deactivation from their Ifme account and complete loss of admin access. Exploit details: not provided in the supplied documents. Remediation...

Learning Courses < 5.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Visit to Paypal Setting Under Learning Plugin Enter the XSS payload " in Email PDT...

Ifme 安全漏洞

Ifme is open source a mental health experience community that encourages people to share their personal stories with trusted allies. Ifme suffers from an access control error vulnerability that can be exploited by an attacker to cause an administrator to deactivate and completely lose administrat...

Nettmp NNT SQL注入漏洞

Nettmp NNT is an off-the-shelf solution for remotely managing temperature, humidity, light and relay-controlled sensors. A SQL injection vulnerability exists in Nettmp NNT version 5.1, which allows an attacker to bypass authentication and access the panel using an administrative account...

CVE-2021-44598

Attendance Management System 1.0 is affected by a Cross Site Scripting XSS vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The attacker can access the system, by using the XSS-reflecte...

CVE-2021-4161

The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server...

Moxa MGate 多款产品安全漏洞

MOXA Moxa MGate MB3280 and Moxa MGate MB3480 are both products of MOXA Corporation, Taiwan, China.Moxa MGate MB3280 is a MB3280 series Ethernet gateway product.Moxa MGate MB3480 is a MB3480 series Ethernet gateway product. A security vulnerability exists in the Moxa MGate MB3180/MB3280/MB3480...