CVE-2022-48359

The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentiality...

Code injection

The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentiality...

Design/Logic Flaw

An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint...

U.S. Dept Of Defense: AWS Credentials Disclosure at ███

Sensitive AWS credentials were disclosed through a config.json file found on a server. An attacker could have used these credentials to gain access to sensitive information on the AWS account or perform arbitrary modifications on AWS resources. The affected system host was not disclosed. No CVE...

Protocol fee rate can be arbitrarily modified by the owner and the new rate will apply to all existing orders

Lines of code Vulnerability details function matchOneToOneOrders OrderTypes.MakerOrder calldata makerOrders1, OrderTypes.MakerOrder calldata makerOrders2 external uint256 startGas = gasleft; uint256 numMakerOrders = makerOrders1.length; requiremsg.sender == MATCHEXECUTOR, 'OME';...

WordPress Content Mask plugin has an unspecified vulnerability

WordPress and WordPress plugin are products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. A security vulnerability exists in versions of WordPress Content Mask plugin prior to 1.8.4.1. The vulnerability...

Schneider Electric Modicon M221 PLCs and SoMachine Basic Protection Mechanism Failure (CVE-2017-7575)

Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \x00\x01\x00\x00\x00\x05\x01\x5a\x00\x03\x00 request to the Modbus port 502/tcp. Subsequently the application may be arbitrarily downloaded, modified, and uploaded...

Google Android security vulnerabilities

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to arbitrarily modify and set system properties...

PT-2021-17226

Name of the Vulnerable Software and Affected Versions: NetApp Clustered Data ONTAP versions prior to 9.5P18 NetApp Clustered Data ONTAP versions prior to 9.6P16 NetApp Clustered Data ONTAP versions prior to 9.7P16 NetApp Clustered Data ONTAP versions prior to 9.8P7 NetApp Clustered Data ONTAP...

CVE-2021-33346

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization...

Ubuntu: Security Advisory (USN-4679-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Logic flaw vulnerability in ejucms Ar***.php file

EJU real estate system ejucms is a set of localized O2O real estate website platform system. ejucms Ar.php file has a logic flaw vulnerability attackers can exploit the vulnerability to arbitrarily modify the listing information...

Design/Logic Flaw

Samsung Kies before 2.5.0.120942711 has arbitrary directory modification...

Authentication flaw

A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 A1WI20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT77616E6771696F6E67" allows unauthenticated attackers to perform arbitrary modification read, write to passwords and configurations meanwhile an...

CVE-2018-8898: Improper Authentication

A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 A1WI20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT77616E6771696F6E67" allows unauthenticated attackers to perform arbitrary modification read, write to passwords and configurations meanwhile an...

Logic design flaws in Vogelmaster's Android app

Wojia General Manager Android APP is a home control software. There is a logic design vulnerability in Wojia General Management Android APP. An attacker can exploit the vulnerability to modify arbitrary payment amount...

Bumble: Arbitrary modification value "session" (Cookie) in badoo.com

Users who log on through https://m.badoo.com/ receive a session cookie named "session" whose value represents the user identifier. I have found a way to change the value of the cookie, this error can be used to: Leave off the application to a particular user to log on again, the attacker would ha...

某网店系统存在越权漏洞(任意用户信息修改)

简要描述： 某网店系统存在越权漏洞任意用户信息修改 详细说明： 账号 A id=375 账号 B id=376 越权修改账号a的信息 成功修改 demo演示站点呢 一样可以修改收货地址 账号A id=362 账号B id=363 img src="https://images.seebug.org/upload/201504/07000058fd624e353d682fc05a6b2efead0a6338.jpg" alt="2.jpg" width="600" onerror=...

FineCMS轻量版csrf漏洞后台添加管理+任意挂黑页

简要描述： FineCMS轻量版csrf漏洞后台添加管理+任意挂黑页 详细说明： 又一个cms的csrf漏洞，没有任何token验证 漏洞证明： 1、后台，管理员，添加 2、抓包截断 没有验证 3、构造表单 4、挂黑页，他有一个模版，里面可以添加修改html文件 截断一下，看也是可以csrf的 img src="https://images.seebug.org/upload/201501/21100205e8d7713cf6b1d8086e7f8660c7201da6...

风讯（FooSun）GetPassword.asp页面存在任意修改密码漏洞

FoosunCMS是一款具有强大的功能的基于ASP+ACCESS/MSSQL构架的内容管理软件。 在文件\User\ GetPassword.asp中： ElseIf Request.Form"Action" = "step3" then //第28行 Call step3 …… Sub step3 //第198行 Dim ppassnew,pconfimpassnew ppassnew = md5Request.Form"passnew",16 …… UserConn.execute"Update FSMEUsers set UserPassword ='"&...