Cross-Site Scripting (XSS)

activemq is vulnerable to cross-site scripting attacks. The vulnerability exists in the web based administration console on the message.jsp which allows an attacker to inject and execute malicious javascript...

PT-2022-7166 · Unknown +1 · H2 Database Engine +1

Name of the Vulnerable Software and Affected Versions: H2 Database Engine versions prior to 2.2.220 Description: The web-based admin console in H2 Database Engine can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web...

H2database 安全漏洞

H2database is an embeddable Rdbms written in Java. A security vulnerability exists in H2database version 2.1.214, which stems from the fact that the web-based administration console can be started via the CLI with the parameter -webAdminPassword, which allows a user to specify the password for th...

CVE-2022-40602

A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00ABLG.6C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authenticated administrator...

CVE-2022-40602

A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00ABLG.6C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authenticated administrator...

PT-2022-27307 · Apache · Axis

Name of the Vulnerable Software and Affected Versions: Appalti & Contratti version 9.12.2 Description: An issue was discovered in the target web applications LFS and DL229, which expose a set of services provided by the Axis 1.4 instance. The Axis AdminService, normally accessible only by...

PT-2022-6022 · Zyxel · Zyxel Lte3301-M209

Name of the Vulnerable Software and Affected Versions: Zyxel LTE3301-M209 versions prior to V1.00ABLG.6C0 Description: A flaw in the Zyxel LTE3301-M209 firmware could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has be...

ZTE ZXHN-H108NS Authentication Bypass Vulnerability

ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7uZRDGR2A68 suffers from an authentication bypass vulnerability when alternate HTTP methods are leveraged. Exploit Title: Router ZTE-H108NS - Authentication Bypass Exploit Author: George Tsimpidas Vendor: https://www.zte.com.cn/global/...

ZTE ZXHN-H108NS Authentication Bypass

Exploit Title: Router ZTE-H108NS - Authentication Bypass Date: 19-11-2022 Exploit Author: George Tsimpidas Vendor: https://www.zte.com.cn/global/ Firmware: H108NSV1.0.7uZRDGR2A68 CVE: N/A Tested on: Debian 5.18.5 Description : When specific http methods are listed within a security constraint, th...

PT-2022-27015 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.31 Description: The issue allows remote authenticated users to modify the query string via direct user input or stored search filter settings in the Admin CP's Users module, resulting in a SQL injection vulnerability...

Moderate: dhcp security and enhancement update

The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to...

ALSA-2022:8162 Moderate: 389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. The following packages have been upgraded to a later upstream version: 389-ds-base 2.1.3...

FreeBSD : Grafana -- Privilege escalation (db895ed0-6298-11ed-9ca2-6c3be5272acd)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db895ed0-6298-11ed-9ca2-6c3be5272acd advisory. - Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and...

CVE-2022-41339

In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation...

CVE-2022-41339

In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation...

PT-2022-25817 · Zoho · Zoho Manageengine Mobile Device Manager Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Mobile Device Manager Plus versions prior to 10.1.2207.5 Description: The issue allows privilege escalation through the User Administration module. Recommendations: For versions prior to 10.1.2207.5, update to version...

Privilege Escalation

github.com/grafana/grafana, is vulnerable to privilege escalation. The vulnerability exists due to the race condition in the authentication middlewares logic, allowing an attacker to query an administration endpoint under a heavy load...

CVE-2022-39328

A race condition was found in Grafana in the middleware logic that could allow bypassing authentication. This flaw allows an unauthenticated user to successfully query an administration endpoint under a heavy load by using a load testing script hitting specific endpoints...

CVE-2022-39328

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

CVE-2022-41258

Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious script when running a common query in the Web Administration Console. On successful exploitation, an attacker can view or modify information causing a limited...