7782 matches found
ConnectWise Quietly Patches Flaw That Helps Phishers
ConnectWise, which offers a self-hosted, remote desktop software application that is widely used by Managed Service Providers MSPs, is warning about an unusually sophisticated phishing attack that can let attackers take remote control over user systems when recipients click the included link. The...
krb5: integer overflow vulnerabilities in PAC parsing
A vulnerability was found in MIT krb5. This flaw allows an authenticated attacker to cause a KDC or kadmind process to crash by reading beyond the bounds of allocated memory, creating a denial of service. A privileged attacker may similarly be able to cause a Kerberos or GSS application service t...
Cross-Site Scripting (XSS)
activemq is vulnerable to cross-site scripting attacks. The vulnerability exists in the web based administration console on the message.jsp which allows an attacker to inject and execute malicious javascript...
H2database 安全漏洞
H2database is an embeddable Rdbms written in Java. A security vulnerability exists in H2database version 2.1.214, which stems from the fact that the web-based administration console can be started via the CLI with the parameter -webAdminPassword, which allows a user to specify the password for th...
PT-2022-7166 · Unknown +1 · H2 Database Engine +1
Name of the Vulnerable Software and Affected Versions: H2 Database Engine versions prior to 2.2.220 Description: The web-based admin console in H2 Database Engine can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web...
CVE-2022-40602
A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00ABLG.6C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authenticated administrator...
CVE-2022-40602
A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00ABLG.6C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authenticated administrator...
PT-2022-27307 · Apache · Axis
Name of the Vulnerable Software and Affected Versions: Appalti & Contratti version 9.12.2 Description: An issue was discovered in the target web applications LFS and DL229, which expose a set of services provided by the Axis 1.4 instance. The Axis AdminService, normally accessible only by...
PT-2022-6022 · Zyxel · Zyxel Lte3301-M209
Name of the Vulnerable Software and Affected Versions: Zyxel LTE3301-M209 versions prior to V1.00ABLG.6C0 Description: A flaw in the Zyxel LTE3301-M209 firmware could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has be...
ZTE ZXHN-H108NS Authentication Bypass Vulnerability
ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7uZRDGR2A68 suffers from an authentication bypass vulnerability when alternate HTTP methods are leveraged. Exploit Title: Router ZTE-H108NS - Authentication Bypass Exploit Author: George Tsimpidas Vendor: https://www.zte.com.cn/global/...
PT-2022-27015 · Mybb · Mybb
Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.31 Description: The issue allows remote authenticated users to modify the query string via direct user input or stored search filter settings in the Admin CP's Users module, resulting in a SQL injection vulnerability...
ZTE ZXHN-H108NS Authentication Bypass
Exploit Title: Router ZTE-H108NS - Authentication Bypass Date: 19-11-2022 Exploit Author: George Tsimpidas Vendor: https://www.zte.com.cn/global/ Firmware: H108NSV1.0.7uZRDGR2A68 CVE: N/A Tested on: Debian 5.18.5 Description : When specific http methods are listed within a security constraint, th...
Moderate: dhcp security and enhancement update
The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to...
ALSA-2022:8162 Moderate: 389-ds-base security, bug fix, and enhancement update
389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. The following packages have been upgraded to a later upstream version: 389-ds-base 2.1.3...
FreeBSD : Grafana -- Privilege escalation (db895ed0-6298-11ed-9ca2-6c3be5272acd)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db895ed0-6298-11ed-9ca2-6c3be5272acd advisory. - Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and...
CVE-2022-41339
In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation...
CVE-2022-41339
In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation...
PT-2022-25817 · Zoho · Zoho Manageengine Mobile Device Manager Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Mobile Device Manager Plus versions prior to 10.1.2207.5 Description: The issue allows privilege escalation through the User Administration module. Recommendations: For versions prior to 10.1.2207.5, update to version...
Privilege Escalation
github.com/grafana/grafana, is vulnerable to privilege escalation. The vulnerability exists due to the race condition in the authentication middlewares logic, allowing an attacker to query an administration endpoint under a heavy load...
CVE-2022-39328
A race condition was found in Grafana in the middleware logic that could allow bypassing authentication. This flaw allows an unauthenticated user to successfully query an administration endpoint under a heavy load by using a load testing script hitting specific endpoints...