Sql injection

SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend in a file readable by unprivileged users. As a result, any user having access to the filesystem can read database login...

CVE-2021-25275

SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend in a file readable by unprivileged users. As a result, any user having access to the filesystem can read database login...

CVE-2021-25769

In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments...

Design/Logic Flaw

In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments...

ovirt-engine: non-admin user is able to access other users public SSH key

A flaw was found in ovirt-engine 4.4.3 and earlier. This flaw allows an authenticated user to read other users' personal information, including the name, email, and public SSH key. The highest threat from this vulnerability is to confidentiality...

CVE-2019-20471

An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. When using the device at initial setup, a default password is used 123456 for administrative purposes. There is no prompt to change this password. Note that this password can be used in combination with CVE-2019-2047...

CVE-2021-21276

Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists regardless of users' settings. If an attacker crafts a reque...

CVE-2021-21276

Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists regardless of users' settings. If an attacker crafts a reque...

Code injection

Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists regardless of users' settings. If an attacker crafts a reque...

CVE-2021-21276

Polr before version 2.3.0 is affected by a setup-process privilege-escalation vulnerability. A loose comparison (==) in SetupController allows an attacker to craft a request to /setup/finish with crafted cookie headers to obtain admin privileges on a site instance, even without an existing accoun...

PT-2021-14382 · Polr · Polr

Name of the Vulnerable Software and Affected Versions: Polr versions prior to 2.3.0 Description: Polr is an open source URL shortener. A vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability...

CVE-2021-21276 Privilege escalation in Polr

Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists regardless of users' settings. If an attacker crafts a reque...

Wwbn Avideo Permission License and Access Control Issues Vulnerability

Wwbn Avideo is a video platform builder written in PHP by the Wwbn WWBN team. AVideo Platform suffers from a Permission Permission and Access Control Issues vulnerability that stems from an authorization bypass vulnerability that could allow a normal user to gain administrative control...

Home Assistant Community Store 1.10.0 Path Traversal

Exploit Title: Home Assistant Community Store HACS 1.10.0 - Path Traversal to Account Takeover Date: 2021-01-28 Exploit Author: Lyghtnox Vendor Homepage: https://www.home-assistant.io/ Software Link: https://github.com/hacs/integration Version: 1.10.0 Tested on: Raspbian + Home Assistant 2021.1.0...

Home Assistant Community Store (HACS) 1.10.0 - Directory Traversal

Exploit Title: Home Assistant Community Store HACS 1.10.0 - Path Traversal to Account Takeover Date: 2021-01-28 Exploit Author: Lyghtnox Vendor Homepage: https://www.home-assistant.io/ Software Link: https://github.com/hacs/integration Version: 1.10.0 Tested on: Raspbian + Home Assistant 2021.1.0...

CVE-2020-35270

Student Result Management System In PHP With Source Code is affected by SQL injection. An attacker can able to access of Admin Panel and manage every account of Result...

CVE-2021-3297

CVE-2021-3297 affects Zyxel NBG2105 devices (V1.00(AAGU.2)C0). The vulnerability is an authentication bypass where setting the login cookie to 1 grants administrator access to the device. This is evidenced by multiple connected sources (e.g., NVD entry, Nuclei template, Red Hat/CIRCL references) ...

Cisco Data Center Network Manager 安全漏洞

Cisco Data Center Network Manager DCNM is a suite of data center network managers from Cisco that provides multiprotocol management of the network and troubleshooting of switch operating conditions and performance. An authorization bypass vulnerability exists in the Web management interface of...

Oracle Fusion Middleware 访问控制错误漏洞

Oracle BI Publisher is a reporting solution that makes it easier and faster than traditional reporting tools to produce, manage and deliver all reports and documents. An unspecified vulnerability exists in the Administration component in Oracle BI Publisher 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0,...

Design/Logic Flaw

Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, a...