BlockDev Sp. Z o.o: [blog.makerdao.com] Multiple Vulnerabilities - Leads to leakage user admin sensitive exposure

blog.makerdao.com Multiple Vulnerabilities - Leads to leakage user admin sensitive exposure...

CVE-2019-16387

PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/randomtoken/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchemaListDatabases request while using a low-privilege account. This can perform actions and retrieve data that only an administrator should have access to. NOTE: The vendor states that...

PT-2019-14652 · Pegasystems · Pega Platform

Name of the Vulnerable Software and Affected Versions: PEGA Platform version 8.3.0 Description: The issue allows a low-privilege account to perform actions and retrieve data that should only be accessible to an administrator. This can be achieved by sending a direct request to the "prweb/sso/rand...

Sql injection

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a...

Zhucheng City Three Swords Network Media Co., Ltd. online shopping mall web system has xss vulnerability

Zhucheng City Three Swords Network Media Co., Ltd. is an Internet web application development company, which has built online shopping mall web systems for many customers. Zhucheng City Three Swords Network Media Co., Ltd. online shopping web system has xss vulnerability, the attacker can embed...

The vulnerability of Microsoft SharePoint Foundation and the Microsoft SharePoint Enterprise Server software suite lies in the lack of protection for administrative data, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of Microsoft SharePoint Foundation and the Microsoft SharePoint Enterprise Server software lies in the lack of protection for business data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created request sent to t...

Dandelion Online Teaching System frontend ex*** routing file has SQL injection vulnerability

Dandelion Online Teaching System is the website of Shenzhen Tomorrow See Technology Co., Ltd, which is an innovative science and technology enterprise focusing on the research and development of videoconferencing, video teaching and telemedicine system. Dandelion Online Teaching System has a SQL...

SQL Injection Vulnerability in Frontend Li*** Routing File of Dandelion Online Teaching System

Dandelion Online Teaching System is the website of Shenzhen Tomorrow See Technology Co., Ltd, which is an innovative science and technology enterprise focusing on the research and development of videoconferencing, video teaching and telemedicine system. Dandelion Online Teaching System has a SQL...

SQL injection vulnerability in frontend we*** routing file of Dandelion online teaching system

Dandelion Online Teaching System is the website of Shenzhen Tomorrow See Technology Co., Ltd, which is an innovative science and technology enterprise focusing on the research and development of videoconferencing, video teaching and telemedicine system. Dandelion Online Teaching System has a SQL...

CVE-2018-9850

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parameter of an Admin-Data-del request...

CVE-2018-9850

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parameter of an Admin-Data-del request...

CVE-2017-17323

Huawei iBMC V200R002C10; V200R002C20; V200R002C30 have an improper authorization vulnerability. The software incorrectly performs an authorization check when a normal user attempts to access certain information which is supposed to be accessed only by admin user. Successful exploit could cause...

XSS vulnerability in old y article management system

The old y article management system is based on the old y Asp Access/Mssql environment developed under the open source website building products . Old y article management system XSS vulnerability , an attacker can use the vulnerability in the member control panel to insert malicious code , and...

OpenEMR Elevation of Privilege Vulnerability

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. An elevation of privilege vulnerability exists in OpenEMR 5.0.1-dev and...

Stock Photo Selling 1.0 - SQL Injection

!/usr/bin/perl -w Exploit Title: Stock Photo Selling Script 1.0 - SQL Injection Dork: N/A Date: 21.09.2017 Vendor Homepage: http://sixthlife.net/ Software Link: http://sixthlife.net/product/stock-photo-selling-website/ Demo: http://www.photoreels.com/ Version: 1.0 Category: Webapps Tested on:...

CVE-2017-6783

A vulnerability in SNMP polling for the Cisco Web Security Appliance WSA, Email Security Appliance ESA, and Content Security Management Appliance SMA could allow an authenticated, remote attacker to discover confidential information about the appliances that should be available only to an...

Code execution vulnerability in javapms

JAVAPMS is a JAVA Portal Management System JAVA Portal Management System for short, SpringMVC + Spring + Hibernate + Freemarker + Html5 + jQuery for the technical core architecture, for the majority of webmasters, software developers, program enthusiasts, web page designers, for individual...

Busewe 1.2 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Busewe - Website Marketplace Software v1.2 - SQL Injection Google Dork: N/A Date: 09.03.2017 Vendor Homepage: https://www.ncrypted.net/ Software: https://www.ncrypted.net/busewe Demo: http://demo.ncryptedprojects.com/busewe/...

Emlog personal blog system exists arbitrary file deletion vulnerability

Short for every memory log, emlog is a PHP and MySQL based blog and CMS builder. The /src/admin/data.php page of the emlog personal blog system has an arbitrary file deletion vulnerability. As Bak fails to bring in the unlink function directly after the restriction, allowing an attacker to delete...

Elevation of Privilege Vulnerability in the background of emlog personal blog system

Short for every memory log, emlog is a PHP and MySQL based blog and CMS builder. A privilege elevation vulnerability exists in the background /src/admin/data.php page of the emlog personal blog system. An attacker can exploit the vulnerability to elevate privileges by importing files...