5361 matches found
Exploit for CVE-2024-32651
CVE-2024-32651 changedetection --port --ip --notification...
Wiz Code: Experience True ASPM With Code-to-Cloud Context
Enhance your application security posture with Wiz Code's integration of 3rd-party SAST scanners and cloud context for faster risk prioritization and remediation...
My Journey To CTO for Imperva App Sec
I’m delighted to be announcing that I’ve joined Imperva as the CTO for Application Security. Many of you readers know me as the Forrester analyst covering Zero Trust, SASE, and network security since before the pandemic. But what you might not have known is prior to that, I was in application...
TYPO3 News Module SQL Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TYPO3 News Module SQL Injection', 'Description' = %q This module exploits a SQL Injection vulnerability In TYPO3 NewsController.php in the news...
Kashipara Hotel Management System Cross-Site Request Forgery Vulnerability
Kashipara Hotel Management System is a hotel management system from Kashipara. A cross-site request forgery vulnerability exists in Kashipara Hotel Management System v1.0, which can be exploited by an attacker to forge a malicious request and trick a victim into clicking on it to perform a...
ROS-20240826-21
Vulnerability of passwordverify function of PHP programming language interpreter is related to flaws in the authentication procedure. of the authentication procedure. Exploitation of the vulnerability could allow an attacker acting remotely Bypass the authentication process and gain unauthorized...
ROS-20240826-22
Vulnerability of passwordverify function of PHP programming language interpreter is related to flaws in the authentication procedure. of the authentication procedure. Exploitation of the vulnerability could allow an attacker acting remotely Bypass the authentication process and gain unauthorized...
Information Disclosure
umbraco.cms is vulnerable Information Disclosure. The vulnerability is due to improper handling of error responses in the Management API, which causes stack trace information to be returned even when Umbraco is not in debug mode. It allows an attacker to gain access to internal details of the...
SourceCodester Online Graduate Tracer System SQL注入漏洞
SourceCodester Online Graduate Tracer System is a web-based application project developed by SourceCodester using PHP and MySQL database. Its main purpose is to provide a platform for a school to track their alumni and generate graphical reports on alumni status. A SQL injection vulnerability...
U.S. Dept Of Defense: Improper Authentication Allows Making Appeals as Other Users
The vulnerability allowed unauthenticated users to submit appeals by manipulating HTTP responses. This undermined the security and integrity of the application, as users could perform actions reserved for logged-in users...
Adobe Illustrator Null Pointer Dereference Vulnerability (CNVD-2024-36027)
Adobe Illustrator is a set of vector-based image creation software from the American company Audobee Adobe. A null pointer dereference vulnerability exists in Adobe Illustrator, which can be exploited by an attacker to cause a denial of service DoS of an application...
CVE-2024-43367 Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects
Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts. Boa's implementation of AsyncGenerator...
CVE-2024-6533
Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with...
Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects
A wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts. Details Boa's implementation of AsyncGenerator makes the assumption that the state of an AsyncGenerator object cannot change while resolving a promise created by method...
CVE-2024-41939
A vulnerability has been identified in SINEC NMS All versions V3.0. The affected application does not properly enforce authorization checks. This could allow an authenticated attacker to bypass the checks and elevate their privileges on the application...
CVE-2024-42373
SAP Student Life Cycle Management SLcM fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to delete non-sensitive report variants that are typically restricted, causing...
CVE-2024-41731
SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application...
CVE-2024-42166
The function "generateappcertificates" in lib/appcertificates.js of FIWARE Keyrock = 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious...
CVE-2024-38271
creationtimestamp| type| source ---|---|--- 2024-08-12 12:44:11+00:00| seen| Telegram/NMamkVEHpjPy75q8OkNF-7ES7f0rvEvrOVZWOzTLall1cnfu 2024-08-14 12:47:24+00:00| published-proof-of-concept| https://t.me/truesecator/6087 2024-08-18 13:28:57+00:00| seen|...
