ASUS BMC Firmware 路径遍历漏洞

ASUS BMC Firmware is a firmware from Asus China. A path traversal vulnerability exists in the ASUS BMC Firmware Web management page, which stems from the Delete SOL video file function not filtering specific parameters. A remote attacker could use this vulnerability to gain administrator privileg...

CVE-2021-24209

The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated admin+ RCE in the settings page due to input validation failure and weak $cachepath check in the WP Super Cache Settings - Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so...

CVE-2021-24175

The CVE-2021-24175 entry concerns The Plus Addons for Elementor Page Builder WordPress plugin, affecting versions before 4.1.7. Concretely, affected functionality allowed unauthenticated attackers to bypass authentication, log in as any user (including admin) by supplying a username, and create a...

Simple Traffic Offense System 1.0 Cross Site Scripting

Exploit Title: Traffic Offense System | Stored Cross Site Scripting Cookie-theft Exploit Author: Richard Jones Date: 03-04-2021 Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/12330/simple-traffic-offense-system-php.html Version: 1.0 Tested On:...

Simple Food Website 1.0 - Authentication Bypass Vulnerability

Exploit Title: Simple Food Website 1.0 - Authentication Bypass Exploit Author: Viren Saroha illusion Vendor Homepage: https://www.sourcecodester.com/php/12510/simple-food-website-php.html Software Link:...

Nextcloud: DoS due to improper input validation can break the admin access into the user data will disallow him from editing that user's data.

Impact A malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. Patches It is recommended that the Nextcloud Server is upgraded to 19.0.11, 20.0.10 or 21.0.2 Workarounds Use the OCC command line tool to...

CVE-2021-28113

A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers with admin access to the Okta Access Gateway UI to execute OS commands as a privileged system account...

CVE-2021-28113

A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers with admin access to the Okta Access Gateway UI to execute OS commands as a privileged system account...

Command injection

A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers with admin access to the Okta Access Gateway UI to execute OS commands as a privileged system account...

CVE-2021-28113

CVE-2021-28113: Okta Access Gateway before 2020.9.3 has command-injection in cookieDomain/relayDomain parameters. Requires admin access to the UI and can lead to OS command execution as a privileged system account. No explicit remediation details in provided documents; mode of exploitation (UI-au...

PT-2021-14913 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to the fixed version Description: An issue has been discovered affecting all previous versions of GitLab CE/EE. It allows for a CSRF attack in System hooks through the API if the victim is an admin. Recommendations...

Controlled Admin Access < 1.5.6 - Improper Access Control to Privilege Escalation

The plugin did not properly restrict access when checking user with limited access, allowing them to query pages they should not be able to, which could lead to privilege escalation by creating a new administrator with full, unrestricted access to the blog. Created a temporary admin account via t...

Testes de Codigo Elevation of Privilege Vulnerability

Testesdecodigogratis Testes de Codigo is a mobile application from Testesdecodigogratis in Portugal that provides users with driver's license learning. A security vulnerability exists in Testes de Codigo 11.4 and prior that allows an attacker to tamper with the Boolean values of the parameters...

INSMA Wifi Mini Spy 1080P HD Security IP Camera 安全漏洞

INSMA Wifi Mini Spy 1080P HD Security IP Camera is a camera from INSMA USA. A security vulnerability exists in INSMA Wifi Mini Spy 1080P HD Security IP Camera version 1.9.7 B, which can be exploited by an attacker to gain administrator privileges via a customized request to "/goform/formUserMng"...

Xerox AltaLink 安全漏洞

Xerox AltaLink is a hardware device from the American Xerox Xerox company. It provides a print-copy function. A security vulnerability exists in Xerox AltaLink that allows the ability to set configuration properties without requiring administrator privileges. The following products and versions a...

WordPress Controlled Admin Access plugin <= 1.5.5 - Improper Input Validation leading to Privilege Escalation vulnerability

Improper Input Validation leading to Privilege Escalation vulnerability discovered by NinTechNet in WordPress Controlled Admin Access plugin versions = 1.5.5. Solution Update the WordPress Controlled Admin Access plugin to the latest available version at least 1.5.6...

Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation

An Improper Access Control vulnerability was discovered in the plugin. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource. Even with the maximu...

Rusavtomatika Weintek EasyWeb cMT 安全漏洞

Rusavtomatika Weintek EasyWeb cMT is an application platform of the Russian company Rusavtomatika. It is used to configure the parameters of the human-machine interface. A security vulnerability exists in Rusavtomatika Weintek EasyWeb cMT that allows an unauthenticated attacker to remotely access...

WordPress Controlled Admin Access plugin <= 1.5.1 - Improper Access Control & Privilege Escalation vulnerability

Improper Access Control & Privilege Escalation vulnerability discovered by m0ze Patchstack Red Team in WordPress Controlled Admin Access plugin versions = 1.5.1. Solution Update the WordPress Controlled Admin Access plugin to the latest available version at least 1.5.2...

CVE-2021-24130

Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user admin+...