7826 matches found
Update 24.4 for Microsoft Dynamics 365 Business Central 2024 Release Wave 1 (Application Build 24.4.22925, Platform Build 24.0.22865)
None None...
The vulnerability of the OTRS system’s administration log module allows a violator to disclose protected information.
The vulnerability of the OTRS application’s administration log module is related to the disclosure of information through registration files. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...
Apache Tomcat User Enumeration
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Tomcat User Enumeration', 'Description' = %q This module enumerates Apache Tomcat's usernames via malformed requests to jsecuritycheck,...
ASB-A-324321147
In rebootRecoveryWithCommand of RecoverySystemService.java, there is a possible way to bypass a factory reset due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...
FileZilla FTP Server Admin Interface Denial of Service
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FileZilla FTP Server Admin Interface Denial of Service', 'Description' = %q This module triggers a Denial of Service condition in the FileZilla F...
The vulnerability in the administration interface of the Zimbra Collaboration Suite email management system allows a hacker to execute arbitrary JavaScript code.
The vulnerability of the administration interface of the Zimbra Collaboration Suite email management system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code by sending a...
D-Link DIR-846W Command Execution Vulnerability
D-Link DIR-846W is a dual-band Gigabit wireless router with second-generation 11AC technology and MU-MIMO technology, supporting dual-band concurrent transmission rates up to 1200Mbps for 200M and above broadband users. The D-Link DIR-846W suffers from a command execution vulnerability that stems...
PT-2024-5964 · D Link · D-Link Dir-846
Name of the Vulnerable Software and Affected Versions: D-Link DIR-846W A1 FW100A43 Description: The issue is related to a remote command execution vulnerability via the tomography ping address parameter in the /HNAP1/ interface. This vulnerability may allow a remote attacker to execute arbitrary...
Helpdeskz 2.0.2 Cross Site Scripting
Exploit Title: Stored XSS Vulnerability via File Name Google Dork: N/A Date: 08 Aug 2024 Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox...
Helpdeskz v2.0.2 - Stored XSS Vulnerability
Exploit Title: Stored XSS Vulnerability via File Name Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox 115.1.0esr 64-bit CVE : N/A Payload: "...
Helpdeskz v2.0.2 - Stored XSS
Exploit Title: Stored XSS Vulnerability via File Name Google Dork: N/A Date: 08 Aug 2024 Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox...
CVE-2024-42611
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery CSRF via admin/adminpage.php?linkid=1&mode=delete...
PT-2024-8634 · Moodle +2 · Moodle +2
Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 4.4.2 Description: A flaw was found in Moodle where sensitive secrets and keys are not excluded from the export of site administration presets, potentially leading to unintentional leakage if shared with a third party...
[SECURITY] Fedora 40 Update: 389-ds-base-3.0.4-2.fc40
389 Directory Server is an LDAPv3 compliant server. The base package includes the LDAP server and command line utilities for server administration...
Security Bulletin: Multiple Security Vulnerabilities in IBM Java Runtime affect IBM License Key Server Administration and Reporting Tool and its Agent
Summary Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition in IBM License Key Server Administration and Reporting Tool ART and Administration Agent. For more information please refer to Oracle's CPU Advisory and the X-Force database entries referenced below. Vulnerability Details...
PT-2024-38489 · Sourcecodester · Sourcecodester Car Driving School Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Car Driving School Management System version 1.0 Description: A problematic issue was found, affecting the save users function of the file admin/user/index.php. This leads to cross-site request forgery, which can be initiated...
Server-Side Template Injection
shopware/core and shopware/platform is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of the context variable in Twig templates, allowing attackers with Administration access to execute arbitrary PHP functions or methods...
CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...
CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...
Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Impact The context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. Example call from PHP: php...