7783 matches found
Elite Graphix Elite Cms SQL注入漏洞
eliteCMS is a popular content management system. A SQL injection vulnerability exists in eliteCMS /admin/functions/functions.php, which can be exploited by remote attackers to submit a special SQL request to manipulate the database, obtain sensitive information or execute arbitrary code...
CVE-2022-21720 SQL injection using custom CSS administration form in GLPI
GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the Entities update right prevents exploitation...
KONNI evolves into stealthier RAT
This blog post was authored by Roberto Santos KONNI is a Remote Administration Tool that has being used for at least 8 years. The North Korean threat actor that is using this piece of malware has being identified under the Kimsuky umbrella. This group has been very busy, attacking political...
WordPress Backup and Staging by WP Time Capsule plugin cross-site scripting vulnerability
WordPress is a set of blogging platforms developed by the WordPress Wordpress Foundation using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in versions of the Backup and Staging by WP Time...
WordPress WooCommerce plugin cross-site scripting vulnerability
WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. A cross-site scripting vulnerability exists in versions of the WordPress plugin WooCommerce prior to 1.1.10. The vulnerability stems from the fact that the WooCommerce WordPress plugin's order...
OneBlog Cross-Site Scripting Vulnerability
OneBlog is a simple and beautiful , powerful and adaptive Java blog. The use of springboot development , front-end use Bootstrap. support for mobile adaptive , with a complete front-end and back-end management functions . OneBlog in version 2.2.8 before the existence of XSS vulnerability , the...
kernel: fs_context: heap overflow in legacy parameter handling
A heap-based buffer overflow flaw was found in the way the legacyparseparam function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged in case of unprivileged user namespaces enabled, otherwise needs namespaced CAPSYSADMIN privile...
CVE-2021-44837
An issue was discovered in Delta RM 1.2. It is possible for an unprivileged user to access the same information as an admin user regarding the risk creation information in the /risque/administration/referentiel/json/create/categorie endpoint, using the idcat1 query parameter to indicate the risk...
CVE-2021-35683
Vulnerability in the Oracle Essbase Administration Services product of Oracle Essbase component: EAS Console. The supported version that is affected is Prior to 11.1.2.4.047. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase...
CVE-2021-35683
Vulnerability in the Oracle Essbase Administration Services product of Oracle Essbase component: EAS Console. The supported version that is affected is Prior to 11.1.2.4.047. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase...
Design/Logic Flaw
Vulnerability in the Oracle Essbase Administration Services product of Oracle Essbase component: EAS Console. The supported version that is affected is Prior to 11.1.2.4.047. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase...
CVE-2021-35683
CVE-2021-35683 affects Oracle Essbase Administration Services (EAS Console) in Oracle Essbase; affected versions are before 11.1.2.4.047. The vulnerability enables a low-privilege, network-accessible attacker over HTTP to compromise EAS, with the potential to takeover the Essbase Administration S...
CVE-2021-35683
Vulnerability in the Oracle Essbase Administration Services product of Oracle Essbase component: EAS Console. The supported version that is affected is Prior to 11.1.2.4.047. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase...
CVE-2021-35683
Vulnerability in the Oracle Essbase Administration Services product of Oracle Essbase component: EAS Console. The supported version that is affected is Prior to 11.1.2.4.047. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase...
Vulnerabilities fixed in Oracle Essbase
Oracle has fixed vulnerabilities in the following products: Hyperion Essbase Hyperion Essbase Administration Services The vulnerabilities potentially enable a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Remote code execution...
Mysiteforme 跨站请求伪造漏洞
Mysiteforme is a permission management system. A cross-site request forgery vulnerability exists in mysiteforme, which stems from a lack of validation for cross-site request forgery in the backend blog administration. An attacker could use a forged malicious request to trick a victim into clickin...
Magento Administration Panel Login Form Bruteforced
The scanner successfully authenticated on the Magento administration panel by using weak or predictable credentials. No source data...
CVE-2021-33827
The filesantivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings...
