CVE-2023-33225

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges...

CVE-2023-23843 SolarWinds Platform Incorrect Comparison Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands...

CVE-2023-23843

The CVE-2023-23843 entry concerns SolarWinds Platform’s UpdateActionsProperties Incorrect Comparison vulnerability. It enables authenticated attackers with administrative access to SolarWinds Web Console to execute arbitrary code/commands; ZDI specifics indicate remote code execution in the conte...

CVE-2023-33225 SolarWinds Platform Deserialization of Untrusted Data Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges...

CVE-2023-23844

The CVE-2023-23844 entry concerns SolarWinds Platform/Orion Platform and a vulnerability titled an Incorrect Comparison Vulnerability. Affected: SolarWinds Platform (Web Console access) with administrative privileges could lead to execution of arbitrary commands with SYSTEM privileges. Root cause...

phpFM 1.7.9 Authentication Bypass / Shell Upload

Exploit Title: phpfm v1.7.9 - Authentication type juggling Date: 2023-07-10 Exploit Author: thoughtfault Vendor Homepage: https://www.dulldusk.com/phpfm/ Software Link: https://github.com/dulldusk/phpfm/ Version: 1.6.1-1.7.9 Tested on: Ubuntu 22.04 CVE : N/A """ An authentication bypass exists in...

phpfm v1.7.9 - Authentication type juggling Exploit

Exploit Title: phpfm v1.7.9 - Authentication type juggling Exploit Author: thoughtfault Vendor Homepage: https://www.dulldusk.com/phpfm/ Software Link: https://github.com/dulldusk/phpfm/ Version: 1.6.1-1.7.9 Tested on: Ubuntu 22.04 CVE : N/A """ An authentication bypass exists in when the hash of...

phpfm v1.7.9 - Authentication type juggling

Exploit Title: phpfm v1.7.9 - Authentication type juggling Date: 2023-07-10 Exploit Author: thoughtfault Vendor Homepage: https://www.dulldusk.com/phpfm/ Software Link: https://github.com/dulldusk/phpfm/ Version: 1.6.1-1.7.9 Tested on: Ubuntu 22.04 CVE : N/A """ An authentication bypass exists in...

PT-2023-4415 · Solarwinds · Solarwinds Orion Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Orion Platform affected versions not specified Description: The issue is related to an Incorrect Comparison Vulnerability in the SolarWinds Orion Platform, specifically in the BlacklistedFilesChecker class. This vulnerability allow...

ICA latency in Director frequently displays high (not 64000ms) when accessed via NetScaler Gateway

When user accessed Virtual Desktop via NetScaler, admin may find the "ICA latency" in Director frequently displays unreasonable high valuenot 64000ms, while "ICA RTT" value is in normal range. It's telling ICA RTT ICA latency. In fact, users have no high latency or bad interaction experience whil...

Incorrect usage of Comparison Operator(==) instead of Asignment Operator(=) in PartnerManagerFactory

Lines of code Vulnerability details Impact The incorrect usage of comparison operator instead of an assignment operator in addPartner and addVault functions could lead to undesirable behaviour. While the mapping partnerIds and vaultIds are supposed to keep track of the IDs, due to the error, thes...

CVAD 2203 CU2: Error: "Your OneDrive folder can't be created in the location you selected.”

On CVAD 2203 CU2, you followedhttps://docs.citrix.com/en-us/profile-management/current-release/configure/enable-the-onedrive-container.html to configure OneDrive Container with Citrix Profile Management but it does not work. The Policy was applied via Citrix Active Directory GPO...

The vulnerability of the Apache OpenMeetings video conferencing software, related to insufficient comparison, allows a intruder to gain unauthorized access to protected information.

The vulnerability of Apache OpenMeetings video conferencing software is related to insufficient comparison. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

LlamaRelativeQuorum isActionApproved / isActionDisapproved check condition error

Lines of code Vulnerability details Impact LlamaRelativeQuorum isActionApproved / isActionDisapproved check condition error: quantity holders. The two cannot be compared. In general quantity holder, so the approver was lower than expected. Proof of Concept diff --git...

GitHub: Git Reference Ambiguity in GitHub - Commit Smuggling, Account Takeover, and Remote Code Execution

A vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling due to an incorrect diff comparison in re-opened pull requests. This affected all versions of GitHub Enterprise Server and was fixed in newer releases...

Amazon Linux AMI : squid (ALAS-2023-1766)

The version of squid installed on the remote host is prior to 3.5.20-17.48. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1766 advisory. Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in...

An oracle deprecation might lead the protocol to sell assets for a low price

Lines of code Vulnerability details During a Dutch Auction, if a user places a bid, the trade is settled in the same transaction. As part of this process, the backing manager tries to call the rebalance function again. The call to rebalance is wrapped in a try-catch block, if an error occurs and...

CVE-2020-36724

The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hashhmac function and the use of a loose comparison on the hash which allows an attacker to trick the functio...

Authentication flaw

The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hashhmac function and the use of a loose comparison on the hash which allows an attacker to trick the functio...

CVE-2020-36724 Wordable <= 3.1.1 - Authentication Bypass

The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hashhmac function and the use of a loose comparison on the hash which allows an attacker to trick the functio...