PT-2021-3865 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions 9.0.0 through 9.5.28 TYPO3 versions 10.0.0 through 10.4.17 TYPO3 versions 11.0.0 through 11.3.0 Description: The issue is related to the components QueryGenerator and QueryView in the TYPO3 content management system, which are...

RestroPress < 2.8.3.1 - Unauthorised AJAX Calls

The plugin did not check for CSRF as well as capability in some of its AJAX calls which should only be accessible by admin. As a result, any authenticated user can change arbitrary order status, as well as access arbitrary order details including PII such as phone number and address PoC Change th...

Profile Builder < 3.4.9 - Admin Access via Password Reset

The plugin has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example. The password reset key is checked against the...

LearningDigital Orca HCM digital learning platform 授权问题漏洞

LearningDigital Orca HCM digital learning platform is a digital learning platform from China's LearningDigital. The Orca HCM digital learning platform suffers from an authorization issue vulnerability, which stems from the lack of authentication on the administration page, which allows remote...

Profile Builder < 3.4.9 - Admin Access via Password Reset

The plugin has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example. PoC The password reset key is checked against...

LearningDigital Orca HCM digital learning platform 安全漏洞

LearningDigital Orca HCM digital learning platform is a digital learning platform from China-based LearningDigital. A security vulnerability exists in the Orca HCM digital learning platform, which stems from the platform's use of a weak factory default administrator password, which is hard-coded...

CVE-2021-35961

Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the system through the default password and obtain the highest permission...

Red Hat Decision Manager 安全漏洞

Red Hat Decision Manager RHDM is a fast, lightweight, cloud-native business rules and decision management platform from Red Hat, USA. Red Hat Decision Manager suffers from a security vulnerability that can be exploited by an authenticated attacker to change the roles they assign in response...

GHSA-FP63-499M-HQ6M Files or Directories Accessible to External Parties in ether/logs

Impact A vulnerability was found that allowed authenticated admin users to access any file on the server. Patches The vulnerability has been fixed in 3.0.4. Workarounds We recommend disabling the plugin if untrustworthy sources have admin access. For more information If you have any questions or...

CVE-2021-36383

Xen Orchestra with xo-web through 5.80.0 and xo-server through 5.84.0 mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit,...

Authorization

Xen Orchestra with xo-web through 5.80.0 and xo-server through 5.84.0 mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit,...

CVE-2021-36383

Xen Orchestra with xo-web through 5.80.0 and xo-server through 5.84.0 mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit,...

CVE-2021-36383

Xen Orchestra with xo-web through 5.80.0 and xo-server through 5.84.0 mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit,...

Metasploit Wrap-up

PrintNightmare Rapid7 security researchers Christophe De La Fuente, and Spencer McIntyre, have added a new module for CVE-2021-34527, dubbed PrintNightmare. This module builds upon the research of Xuefeng Li, Zhang Yunhai, Zhiniang Peng, Zhipeng Huo, and cube0x0. The module triggers a remote DLL...

Design/Logic Flaw

Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to 3.0.4 that allowed authenticated admin users to access any file on the server. The vulnerability has been fixed in version 3.0.4. As a workaround, one may...

CVE-2021-32752

Ether Logs (Craft 3) prior to version 3.0.4 is affected. An authenticated admin can access any file on the server due to a vulnerability in the plugin’s handling of file access. The issue has been fixed in version 3.0.4. As a workaround, disable the plugin if admin access by untrusted sources is ...

CVE-2021-32752 Files or Directories Accessible to External Parties in ether/logs

Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to 3.0.4 that allowed authenticated admin users to access any file on the server. The vulnerability has been fixed in version 3.0.4. As a workaround, one may...

CVE-2021-32535

QSAN SANOS contains a hard-coded default-credentials flaw that allowed unauthenticated remote attackers to gain administrator privileges and execute arbitrary functions. A fix is available in SANOS v2.1.0. The vulnerability is documented across multiple sources (NVD, CVE, CVE List) with high to c...

CVE-2021-32525

The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the administrator’s credential, entering the hard-coded password of the debug mode to execute the restricted system instructions. The referred vulnerability has been...

QSAN SANOS 信任管理问题漏洞

QSAN SANOS is the SAN storage management operating system from QSAN China. It comes with a refreshingly simple and easy-to-use Web GUI and can be easily deployed into any infrastructure. A trust management issue vulnerability exists in QSAN SANOS, which stems from the presence of hard-coded defau...