CVE-2020-6287_SAP-NetWeaver-bypass-auth

CVE-2020-6287SAP-NetWeaver-bypass-auth CVE-2020-6287 자동 익스플로잇 CVE-2020-6287: SAP NetWeaver AS JAVA LM Configuration Wizard, 버전 7.30, 7.31, 7.40, 7.50은 인증 확인을 수행하지 않으므로, 사전 인증 없이 공격자가 SAP Java 시스템에 대해 중요한 작업관리 사용자 생성 등을 수행할 수 있도록 구성 작업을 실행할 수 있습니다. 이로 인해 시스템의 기밀성, 무결성 및 가용성이 손상되어 누락된 인증 확인Missing...

CVE-2025-34227_Nagios-XI-Command-Injection-Configuration-Wizard

CVE-2025-34227 Nagios XI Configuration Wizard의 인증된 명령 주입 CVE-2025-34227에 대한 간단한 개념 증명PoC 저장소입니다. Nagios XI - Configuration Wizard에서 발생하는 인증된 명령 주입 취약점입니다. 전체 분석 글: https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/ curl 개념 증명PoC 아래의 페이로드는 database 매개변수에 포함되어 있습니다: ;touch...

CVE-2020-6287

CVE-2020-6287 SAP NetWeaver AS JAVA LM 구성 마법사 인증 우회 일반 및 관리자 Java 사용자 생성 SAP NetWeaver는 SAP Business Suite 이후 모든 SAP 애플리케이션의 기술적 기반이 되는 SAP의 통합 기술 플랫폼입니다. SAP NetWeaver는 SAP 애플리케이션을 위한 개발 및 실행 환경을 제공하는 서비스 지향형 애플리케이션 및 통합 플랫폼으로, 맞춤형 개발과 다른 애플리케이션 및 시스템과의 통합에도 사용할 수 있습니다. SAP NetWeaver AS JAVALM 구...

CVE-2020-6286

CVE-2020-6286 SAP NetWeaver AS JAVA LM Configuration Wizard 디렉터리 트래버설 SAP NetWeaver는 SAP의 통합 기술 플랫폼이자 SAP Business Suite 이후 모든 SAP 애플리케이션의 기술적 기반입니다. SAP NetWeaver는 서비스 지향적 애플리케이션 및 통합 플랫폼으로서, SAP 애플리케이션을 위한 개발 및 실행 환경을 제공하며 맞춤형 개발과 다른 애플리케이션 및 시스템과의 통합에도 사용할 수 있습니다. SAP NetWeaver AS JAVALM...

The vulnerability in the web interface of the SAP NetWeaver Application Server Java Configuration Wizard allows attackers to perform cross-site scripting attacks.

The vulnerability of the SAP NetWeaver Application Server Java Configuration Wizard web interface is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2026-44752 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard)

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data...

CVE-2025-12108

The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration wizard immediately without a login prompt or credentials check...

CVE-2025-12108 Missing Authentication for Critical Function Survision License Plate Recognition Camera

The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration wizard immediately without a login prompt or credentials check...

CVE-2025-12108 Missing Authentication for Critical Function Survision License Plate Recognition Camera

The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration wizard immediately without a login prompt or credentials check...

PT-2025-45029

Name of the Vulnerable Software and Affected Versions Survision LPR Camera system affected versions not specified Description The Survision LPR Camera system lacks default password protection. This allows immediate access to the configuration wizard without requiring a login or checking...

CVE-2025-12108: Missing Authentication for Critical Function

The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration wizard immediately without a login prompt or credentials check...

CVE-2024-14008

Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations...

CVE-2024-14008 Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard

Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations...

CVE-2024-14008: Improper Neutralization of Special Elements used in an OS Command

Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2024R1.3.2, which stems from insufficient...

EUVD-2020-28460

Malware in sbrugna...

EUVD-2000-0051

Malware in sbrugna...

EUVD-2024-50420

Malicious code in bioql PyPI...

CVE-2025-34227 Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection

Nagios XI 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system...

Citrix Provisioning - Configuration Wizard fails after upgrade to 2503

PVS Configuration Wizard fails with errors after PVS upgrade to version 2503. ConfigWizard.log located in C:\ProgramData\Citrix\Provisioning Services\Log on the PVS Server shows: ERROR:SqlException caught, Number = 207, Message = Invalid column name 'isXsProxyConfigRequired'. Updating server...