4070 matches found
Command Execution Vulnerability in Tongda CMS Clothing Company Website System
Tongda CMS clothing company website system is developed by PHP+MYSQL. Support pseudo-static function, can generate google and baidu map, support custom url, keywords and description, in line with SEO standards. Command execution vulnerability exists in Tundra CMS Garment Company website system,...
WordPress Social Sharing Cross-Site Request Forgery Vulnerability
WordPress is a blogging platform developed using the PHP language, which supports the setting up of personal blog sites on servers with PHP and MySQL. It is widely used internationally and is compatible with self-developed plug-ins. Powerful and widely used.Social Sharing is a social sharing plug...
Cisco Prime License Manager Software Trust Management Issues Vulnerability
Cisco Prime License Manager Software is a set of license management software for Cisco products from the U.S. company Cisco Cisco. A trust management issue vulnerability exists in the web management interface in Cisco Prime License Manager PLM Software versions 10.52SU9 and earlier, and 11.51SU6...
CVE-2020-5246
Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges. The issue only impacts instances wit...
Design/Logic Flaw
Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges. The issue only impacts instances wit...
CVE-2020-5246 LDAP injection vulnerability in Traccar GPS Tracking System
Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges. The issue only impacts instances wit...
CVE-2020-6280
SAP NetWeaver ABAP Server and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure...
CVE-2020-6280
SAP NetWeaver ABAP Server and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure...
Information disclosure
SAP NetWeaver ABAP Server and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure...
openstack-keystone: Credentials endpoint policy logic allows changing credential owner and target project ID
A vulnerability was found in Keystone's EC2 credentials API. This flaw allows any authenticated user to create an EC2 credential for themselves for a project that they have a specified role, and then perform an update to the credential user and project, allowing them to masquerade as another user...
Cross-Site Request Forgery (CSRF)
nukeviet/nukeviet is vulnerable to cross site request forgery CSRF. The vulnerability exists as the application is not able to verify the authenticity of requests. An attacker is able to exploit the vulnerability and submit requests on behalf of the user to change profile details and password of...
CVE-2020-6644
An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...
Session fixation
An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...
CVE-2020-6644
FortiDeceptor 3.0.0 and earlier suffer an insufficient session expiration vulnerability: an attacker who obtains an unexpired admin session ID can reuse it to gain admin privileges after logout. The connected sources confirm the affected product and the root cause (unexpired session IDs) but do n...
CVE-2020-6644
An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...
CVE-2020-6644
An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...
Session ID does not expire after logout in FortiDeceptor
An insufficient session expiration vulnerability in FortiDeceptor may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...
CVE-2020-3972
VMware Tools for macOS 11.x.x and prior before 11.1.1 contains a denial-of-service vulnerability in the Host-Guest File System HGFS implementation. Successful exploitation of this issue may allow attackers with non-admin privileges on guest macOS virtual machines to create a denial-of-service...
CVE-2020-3972
VMware Tools for macOS 11.x.x and prior before 11.1.1 contains a denial-of-service vulnerability in the Host-Guest File System HGFS implementation. Successful exploitation of this issue may allow attackers with non-admin privileges on guest macOS virtual machines to create a denial-of-service...