CVE-2024-41517

An Incorrect Access Control vulnerability in "/admin/benutzer/institution/rechteverwaltung/uebersicht" in Feripro = v2.2.3 allows remote attackers to get a list of all users and their corresponding privileges...

Detecting evolving threats: NetSupport RAT campaign

Cisco Talos is actively tracking multiple malware campaigns that utilize NetSupport RAT for persistent infections. These campaigns evade detection through obfuscation and updates. Snort can provide a strong defense before this malware reaches endpoints. In this first Deep Dive with NTDR, we explo...

Ibexa Admin UI 安全漏洞

Ibexa Admin UI is an open source UI interface for Ibexa. Dedicated to the Ibexa Admin UI Bundle. A security vulnerability exists in Ibexa Admin UI that stems from the file upload widget being susceptible to a cross-site scripting payload in the file name...

Security Bulletin: IBM Common Licensing's Administration And Reporting Tool (ART) and IBM LKS Administration Agent are affected by Spring Framework vulnerabilities.

Summary Multiple vulnerabilites in Spring Framework affect IBM Common Licensing. Security Vulnerablities have been addressed in IBM Common Licensing. Remediations/Fixes section address remediation actions. Vulnerability Details CVEID:CVE-2023-20863 DESCRIPTION: VMware Tanzu Spring Framework is...

Pimcore 安全漏洞

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates applications for Web content management, e-commerce frameworks and product information management. A security vulnerability exists in...

CVE-2024-40117

Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the web administration server. Not existing for SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 /...

CVE-2024-40117

Solar-Log 1000 is affected by an improper access control vulnerability that, in versions prior to v2.8.2 and build 52- 23.04.2013, can allow an attacker to obtain administrative privileges by connecting to the web administration server. The affected line items in public sources indicate no impact...

CVE-2024-40117

Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the web administration server. Not existing for SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 /...

PT-2024-28787 · Sl Base +1 · Sl Base +6

Name of the Vulnerable Software and Affected Versions: Solar-Log 1000 versions prior to v2.8.2 and build 52- 23.04.2013 Solar-Log 250, 300, 1200, 2000, SL 50 Gateway versions prior to 4.2.8 SL Base versions prior to 5.1.2 and 6.0.0 Description: The issue is related to incorrect access control,...

CVE-2024-40117

Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the web administration server. Not existing for SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 /...

Multi Store Inventory Management System 1.0 Insecure Direct Object Reference

==================================================================================================================================== | Title : Multi Store Inventory Management System v1.0 IDOR Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0....

ForIP Tecnologia Administração PABX SQL注入漏洞

ForIP Tecnologia Administração PABX is a phone system from ForIP Tecnologia. A SQL injection vulnerability exists in ForIP Tecnologia Administração PABX version 1.x. The vulnerability stems from the usuario parameter of the /login page containing a SQL injection vulnerability...

Candy Redis 2.1.2 Admin Page Disclosure

==================================================================================================================================== | Title : Candy Redis V2.1.2 HTML Form in redirect page Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64...

The vulnerability of the BuildClient function (client_service.go) in the CHAOS remote administration tool allows a hacker to execute arbitrary code.

The vulnerability of the BuildClient function in clientservice.go, a remote administration tool for CHAOS, exists due to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

D-Link DAP-1325 SubnetMask Command Injection Vulnerability

D-Link DAP-1325 is a wireless access point/bridge made by D-Link, which is mainly used to extend the wireless network coverage, support the conversion of wired network to wireless network or connect different wireless networks. The D-Link DAP-1325 suffers from a command injection vulnerability th...

[SECURITY] Fedora 39 Update: pgadmin4-7.8-7.fc39

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

Provisioning Services: Service Account Permissions and Configuration for Accessing PVS SQL Database

This article provides a description on how different service accounts should be configured to grant adequate SQL permissions. Service Account Configuration for Accessing SQL Service users are the accounts under which the Stream and Soap services run on a Provisioning Services PVS server which nee...

Vulnerability in License Server and Snap-in for Desktop Studio, aka Heartbleed

Secure Configuration of Licensing Heartbleed Update In response to the recent Heartbleed vulnerability in OpenSSL CVE-2014-0160 Citrix released a security advisory, CTX140605, advising customers of its potential effects on some Citrix Licensing components. As part of the Citrix response to this...

D-Link DIR-2640 Authentication Bypass Vulnerability

The D-Link DIR-2640 is a high power Wi-Fi router manufactured by the Chinese company AUO D-Link, which is mainly used to provide wireless network connectivity. The D-Link DIR-2640 suffers from an authentication bypass vulnerability that stems from the HNAP PrivateLogin authentication bypass...

PT-2024-21646 · Decidim · Decidim

Name of the Vulnerable Software and Affected Versions: Decidim versions prior to 0.27.6 Decidim versions prior to 0.28.1 Description: Decidim is a participatory democracy framework. The admin panel is subject to potential cross-site scripting XSS attack in case the attacker manages to modify some...