CVE-2023-2991 Fortra Globalscape Administration Server Information Disclosure

Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape is installed on can be remotely determined via a "trial extension request" message...

CVE-2023-28800 Output encoding missing in redrurl parameter

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...

CVE-2023-2989 Fortra Globalscape Administration Server Out of Bounds Memory Read

Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash the service or bypass authentication if successfully exploited...

CVE-2023-2989

CVE-2023-2989 affects Fortra Globalscape EFT administration server prior to 8.1.0.16, due to an out-of-bounds memory read that can permit authentication bypass. Public details describe a blind read flaw in the EFT admin protocol, enabling a logged-in attacker to impersonate another user under cer...

CVE-2023-2989 Fortra Globalscape Administration Server Out of Bounds Memory Read

Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash the service or bypass authentication if successfully exploited...

Zscaler Client Connector 跨站脚本漏洞

Zscaler Client Connector is an application from zscaler. An application installed on a device that ensures that Internet traffic and access to an organization's internal applications are secure and comply with the organization's policies, even when not on the corporate network. A security...

VulnCheck KEV: CVE-2022-45699

Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter...

CVE-2023-0971

A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered...

CVE-2023-0971 Command Authentication Bypass in Z/IP Gateway

A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered...

CVE-2023-0971

SiLabs Z/IP Gateway SDK 7.18.02 and earlier are affected by a logic error that allows authentication bypass, enabling remote administration of Z‑Wave controllers and recovery of S0/S2 encryption keys. The Red Hat/NVD/CVE entries corroborate this description, with no exploitation details provided ...

CVE-2023-0971 Command Authentication Bypass in Z/IP Gateway

A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered...

PT-2023-16655 · Silabs · Silabs Z/Ip Gateway

Name of the Vulnerable Software and Affected Versions: SiLabs Z/IP Gateway SDK versions 7.18.02 and earlier Description: A logic error allows authentication to be bypassed, enabling remote administration of Z-Wave controllers and the recovery of S0/S2 encryption keys. Recommendations: For version...

User Registration & Login and User Management System 跨站脚本漏洞

User Registration & Login and User Management System is a user management system with an administration panel. A security vulnerability exists in User Registration & Login and User Management System v1.0, which originates from cross-site scripting XSS in the component /admin/search-result.php...

NetArt Media PHP Hotel Site 2.0 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

Broken Authentication

Description I tested the demo site you provided. I see that there is an Broken Authentication vulnerability in Administration: CPU stats API. The Administration: CPU stats API does not validated user permissions. Proof of Concept link video PoC https://screenpal.com/watch/c01F1bVBmX1 Step 1. In t...

Able to edit users owned by other administration users

Description Exploiting a vulnerability 'Take ownership' of any user, thereby being able to edit all users. Proof of Concept Step 1: We have user1 owned by admin1. \ Step 2: By doing the 'Take ownership' action, the user1 is now owned by admin2 \ \ Step 3: Now, admin2 is able to edit user1, and ev...

GHSA-96XV-RMWJ-6P9W Grav Server-side Template Injection (SSTI) via Twig Default Filters

Hi, actually we have sent the bug report to [email protected] on 27th March 2023 and on 10th April 2023. Grav Server-side Template Injection SSTI via Insufficient Validation in filterFilter Summary: | Product | Grav CMS | | ----------------------- | --------------------------------------------...

CVE-2023-34880

cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the addaction method at lib/admin/languageadmin.php. This vulnerability allows attackers to execute arbitrary code and perform a local file inclusion...

Improper Access Control

com.liferay.object.web is vulnerable to Improper Access Control. The vulnerability exists because the object module in the library does isolate objects in different virtual instances, which allows remote authenticated users in one virtual instance to view objects in a separate virtual instance vi...

CmsEasy 路径遍历漏洞

CmsEasy is a content management system CMS for creating responsive websites from China's Kyushu Yitong Technology CmsEasy. A security vulnerability exists in CmsEasy version v7.7.7.7 20230520, which originates from a path traversal vulnerability in the addaction method in...