CVE-2020-35370

A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code executionRCE on the...

CVE-2020-35370

A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code executionRCE on the...

Design/Logic Flaw

A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code executionRCE on the...

CVE-2020-35370: Improper Limitation of a Pathname to a Restricted Directory

A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code executionRCE on the...

PT-2020-17317

Name of the Vulnerable Software and Affected Versions Raysync versions prior to 3.3.3.8 Description A remote code execution issue exists, allowing an unauthenticated attacker to send a crafted request and override a specific file on the server with malicious content. This can enable the attacker ...

Raysync 代码注入漏洞

Raysync is a cloud platform for storing and transferring large files. A remote code execution vulnerability exists in Raysync versions prior to 3.3.3.8. The vulnerability can be exploited to remotely execute code on a hosted server by sending a specially crafted request to overwrite a specific fi...

CVE-2020-29583

Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges...

Egavilanmedia ECM Address Book SQL Injection Vulnerability

Egavilanmedia ECM Address Book is a platform for organizing and identifying address books from Egavilanmedia, USA. An SQL injection vulnerability exists in EgavilanMedia ECM Address Book 1.0, which can be exploited to bypass the administrative login panel via SQLi, gain administrative access, and...

CVE-2020-35276

EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user...

PT-2020-17308

Name of the Vulnerable Software and Affected Versions EgavilanMedia ECM Address Book version 1.0 Description The issue allows an attacker to bypass the Admin Login panel through SQL injection, gaining Admin access and the ability to add or remove any user. This can potentially lead to unauthorize...

Egavilanmedia ECM Address Book SQL注入漏洞

Egavilanmedia ECM Address Book is a platform for organizing and identifying address books from Egavilanmedia, USA. An SQL injection vulnerability exists in EgavilanMedia ECM Address Book 1.0, which can be exploited to bypass the administrative login panel via SQLi, gain administrative access, and...

CVE-2020-35276: Improper Neutralization of Special Elements used in an SQL Command

EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user...

SolarWinds N-Central Trust Management Issue Vulnerability

SolarWinds N-Central is an IT device management platform from SolarWinds Singapore. The platform provides proactive monitoring of everything on a customer's network, not just servers and workstations, and rapid troubleshooting using features such as MFA, antivirus, integrated endpoint detection a...

CVE-2020-35416

Multiple cross-site scripting XSS vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage with different request parameters, allows remote attackers to inject arbitrary web script or HTML...

PT-2020-6157 · Phpjabbers · Phpjabbers Appointment Scheduler

Name of the Vulnerable Software and Affected Versions: PHPJabbers Appointment Scheduler version 2.3 Description: The issue is related to cross-site scripting XSS vulnerabilities in the admin login webpage of the PHPJabbers Appointment Scheduler. These vulnerabilities allow remote attackers to...

Phpjabbers Appointment Scheduler 跨站脚本漏洞

Phpjabbers Appointment Scheduler is a Php-based appointment scheduler plugin for planning time and scheduling meetings from Phpjabbers Serbia. PHPJabbers Appointment Scheduler 2.3 is vulnerable to a cross-site scripting vulnerability that originates in the index.php administrative login page with...

Online Bus Ticket Reservation 1.0 SQL Injection

Exploit Title: Online Bus Ticket Reservation 1.0 - SQL Injection Date: 2020-12-07 Exploit Author: Sakshi Sharma Vendor Homepage: https://www.sourcecodester.com/php/5012/online-bus-ticket-reservation-using-phpmysql.html Software Link:...

CVE-2020-28206

An issue was discovered in Bitrix24 Bitrix Framework 1c site management 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows...

CVE-2020-28206

An issue was discovered in Bitrix24 Bitrix Framework 1c site management 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows...

CVE-2020-28206: Improper Restriction of Excessive Authentication Attempts

An issue was discovered in Bitrix24 Bitrix Framework 1c site management 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows...