7785 matches found
IBM: SQL Injection in IBM access control panel & Broken access in admin panel
An application endpoint was found to be vulnerable to SQL Injection caused by a lack of sanitation on the clientid parameter. An adversary would eventually be able to read sensitive data from the database, or modify it as well as to execute administration operations. This was reported to IBM and...
Apache James Server 2.3.2 - Remote Command Execution (Authenticated) Exploit (2)
Exploit Title: Apache James Server 2.3.2 - Remote Command Execution RCE Authenticated 2 Exploit Author: shinris3n Vendor Homepage: http://james.apache.org/server/ Software Link: http://ftp.ps.pl/pub/apache/james/server/apache-james-2.3.2.zip Version: Apache James Server 2.3.2 Tested on: Ubuntu...
Apache James Server 2.3.2 - Remote Command Execution (RCE) (Authenticated) (2)
Exploit Title: Apache James Server 2.3.2 - Remote Command Execution RCE Authenticated 2 Date: 27/09/2021 Exploit Author: shinris3n Vendor Homepage: http://james.apache.org/server/ Software Link: http://ftp.ps.pl/pub/apache/james/server/apache-james-2.3.2.zip Version: Apache James Server 2.3.2...
CVE-2021-36876 WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
Multiple Cross-Site Request Forgery CSRF vulnerabilities in WordPress uListing plugin versions = 2.0.5 as it lacks CSRF checks on plugin administration pages...
emp3r0r
It is an offensive tool for Linux systems. The tool is called emp3r0r, a Linux post-exploitation framework made by a user named jm33-ng. It is designed to provide a better experience for remote administration on Linux systems, particularly for terminal-based interactions. The framework is written...
This Week in Security News - September 24, 1021
Water Basilik Uses New HCrypt Variant to Flood Victims With RAT Payloads & Biden Administration Issues Sanctions To Counter Ransomware...
Feds Sanctions SUEX Cryptocurrency Exchange for Laundering Ransomware Payouts
In an unprecedented move, the federal government has sanctioned a cryptocurrency exchange for laundering ransom transactions for cybercriminals and helping them evade law-enforcement activity. As part of its continued hardline against ransomware attacks, the U.S. Department of Treasury has...
CVE-2021-41382
Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface...
Moodle 信息泄露漏洞
Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. An information disclosure vulnerability exists in Moodle that stems from insufficient escaping of LaTeX leading codes. A remote...
CVE-2021-29825
IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server could disclose sensitive information when using ADMINCMD with LOAD or BACKUP. IBM X-Force ID: 204470...
Update 18.5 for Microsoft Dynamics 365 Business Central 2021 Release Wave 1 (Application Build 18.5.29545, Platform Build 18.0.29486): September 14, 2021 (KB5006076)
None None...
Vulnerability of the function in /administration/theme.php of the PHP-Fusion CMS system, allowing a hacker to execute arbitrary code
The vulnerability in the /administration/theme.php function of the PHP-Fusion CMS system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through the created malicious load...
CVE-2021-40537
Server Side Request Forgery SSRF vulnerability exists in owncloud/userldap 0.15.4 in the settings of the userldap app. Administration role is necessary for exploitation...
CVE-2021-40537
Server Side Request Forgery SSRF vulnerability exists in owncloud/userldap 0.15.4 in the settings of the userldap app. Administration role is necessary for exploitation...
Server side request forgery (ssrf)
Server Side Request Forgery SSRF vulnerability exists in owncloud/userldap 0.15.4 in the settings of the userldap app. Administration role is necessary for exploitation...
CVE-2021-40537
Server Side Request Forgery SSRF vulnerability exists in owncloud/userldap 0.15.4 in the settings of the userldap app. Administration role is necessary for exploitation...
GHSA-7VMW-7X57-Q6JW Cross-site scripting
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overvi...
CVE-2021-40537
Server Side Request Forgery SSRF vulnerability exists in owncloud/userldap 0.15.4 in the settings of the userldap app. Administration role is necessary for exploitation...
The vulnerability of the PHP-Fusion CMS system, which exists due to the lack of measures taken to protect the structure of web pages, allows attackers to execute arbitrary code.
The vulnerability in the /administration/settingsregistration.php function of the PHP-Fusion CMS system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely by using a specially created...