109 matches found
CVE-2023-2824
A vulnerability was found in SourceCodester Dental Clinic Appointment Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/service.php of the component POST Parameter Handler. The manipulation of the argument service lea...
PT-2023-21639 · Sourcecodester · Sourcecodester Dental Clinic Appointment Reservation System
Name of the Vulnerable Software and Affected Versions: SourceCodester Dental Clinic Appointment Reservation System version 1.0 Description: A problematic issue was found in the system, affecting some unknown functionality of the file /admin/service.php, specifically the POST Parameter Handler...
CVE-2023-2096
A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/servicerequests/manageinventory.php. The manipulation of the argument id leads to sql injection. It is possible to launch the...
PT-2023-12765 · Canon · Canon Imageclass Mf644Cdw
Name of the Vulnerable Software and Affected Versions: Canon imageCLASS MF644Cdw version 10.02 Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the...
CVE-2022-44784
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of services provided by the Axis 1.4 instance, embedded directly into the applications, as hinted by the WEB-INF/web.xml file leaked through Local File Inclusion. Among the exposed...
Vulnerability of the /admin/service/stop/ component of the TrueConf Server software, which allows a attacker to perform a CSRF attack
The vulnerability of the /admin/service/stop/ component of the TrueConf Server is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack remotely...
CVE-2017-20120
A vulnerability classified as problematic was found in TrueConf Server 4.3.7. This vulnerability affects unknown code of the file /admin/service/stop/. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may ...
CVE-2022-29653
OFCMS v1.1.4 was discovered to contain a cross-site scripting XSS vulnerability via the component /admin/comn/service/update.json...
WSO2 Carbon directory traversal vulnerability
Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the logFile parameter to downloadgz-ajaxprocessor.jsp...
GHSA-MJWW-VQQW-V78Q WSO2 Carbon directory traversal vulnerability
Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the logFile parameter to downloadgz-ajaxprocessor.jsp...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the logFile parameter in the LogViewer Admin Service. An attacker can read arbitrary files by manipulating the input to include directory traversal sequences such as .. dot dot. This is only exploitable if the...
PT-2022-16916 · Minio +1 · Minio +1
Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2022-04-12T06-55-35Z Description: A security issue was found in MinIO where a non-admin user can create service accounts for root or other admin users and then assume their access policies via the generated...
CVE-2021-43954
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery SSRF vulnerability...
Veritas Enterprise Vault EVExchangeWebServicesProxy Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Veritas Enterprise Vault. Authentication is not required to exploit this vulnerability. The specific flaw exists within EVExchangeWebServicesProxy.exe. The issue results from the lack of proper...
Veritas Enterprise Vault MonitoringAgent Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Veritas Enterprise Vault. Authentication is not required to exploit this vulnerability. The specific flaw exists within MonitoringAgent.exe. The issue results from the lack of proper validation of...
Sage Group Sage X3 信息泄露漏洞
Sage Group Sage X3 is an application from Sage Group, Inc. an enterprise resource planning product developed for mature organizations. An information disclosure vulnerability exists in Sage X3 where the Metasploit module exploits an authentication bypass vulnerability in the Sage X3 AdxSrv...
CVE-2020-15170
apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internetwhich is not recommended, there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Maliciou...
GHSA-9VXC-G2JX-QJ3P API Admin Auth Weakness in tomato
Versions of tomato prior to 0.0.6 are affected by a somewhat complex authentication bypass vulnerability in the admin service when only a single access key is configured on the server. The vulnerability allows an attacker to guess the password for the admin service, no matter how complex that...
CVE-2020-9414
The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user with specific permissions to obtain the session identifier of another user...
