604 matches found
CVE-2022-3857
Maintainer contacted. This is a false-positive. The flaw does not actually exist and was erroneously tested...
UBUNTU-CVE-2022-3857
Rejected reason: Maintainer contacted. This is a false-positive. The flaw does not actually exist and was erroneously tested...
Osprey Pump Controller 1.0.1 Administrator Backdoor Access
Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...
SUSE CVE-2022-3857
Maintainer contacted. This is a false-positive. The flaw does not actually exist and was erroneously tested...
Micro Focus GroupWise Session ID Disclosure
Trovent Security Advisory 2203-01 Micro Focus GroupWise transmits session ID in URL Overview Advisory ID: TRSA-2203-01 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2203-01 Affected product: Micro Focus GroupWise Affected version: prior to 18.4.2...
jiluoil.com Cross Site Scripting vulnerability OBB-2321329
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
COMMAX Smart Home Ruvie CCTV Bridge DVR Service Unauthenticated Config Write / DoS
Summary COMMAX Smart Home System is a smart IoT home solution for a large apartment complex that provides advanced life values and safety. Description The application allows an unauthenticated attacker to change the configuration of the DVR arguments and/or cause denial-of-service scenario throug...
COMMAX CVD-Axx DVR 5.1.4 Weak Default Credentials Stream Disclosure
Summary COMMAX offers a wide range of proven AHD CCTV systems to meet customer needs and convenience in single or multi-family homes. Description The web control panel uses weak set of default administrative credentials that can be easily guessed in remote password attacks and disclose RTSP strea...
IntelliChoice eFORCE Software Suite v2.5.9 Username Enumeration
Summary IntelliChoice is a United States software company that was founded in 2003, and offers a software title called eFORCE Software Suite. eFORCE Software Suite is law enforcement software, and includes features such as case management, court management, crime scene management, criminal...
Security Bulletin: A vulnerability in IBM Spectrum Scale could allow an authenticated user to gain elevated privileges (CVE-2020-9492)
Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale HDFS Transparency that could allow a remote authenticated user to gain elevated privileges. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-9492 DESCRIPTION: Apache Hadoop cou...
WP Prayer < 1.6.7 - Arbitrary Plugin Settings Update via CSRF
The plugin did not properly check for CSRF in some of its module functions, allowing attacker to make logged in admin change all plugin's settings including the email settings for example. v1.6.6 fixed most of CSRF checks, but the one in model.emailsettings.php was improperly fixed bypass still...
Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event. Edit WPScanTeam January 22nd, 2021...
Selea CarPlateServer (CPS) v4.0.1.6 Local Privilege Escalation
Summary Our CPS Car Plate Server software is an advanced solution that can be installed on computers and servers and used as an operations centre. It can create sophisticated traffic control and road safety systems connecting to stationary, mobile or vehicle-installed ANPR systems. CPS allows to...
Wibar < 1.2.1 - Authenticated Stored Cross-Site Scripting
The theme contains a Brands feature which is vulnerable to stored Cross Site Scripting XSS within the logo URL parameter. Edit WPScanTeam November 27th, 2020 - Vendor Contacted via https://themeftc.ticksy.com/submit/ November 28th-29th, 2020 - Exchanges with vendor's support but they do not...
marco-polo-peich.de Cross Site Scripting vulnerability OBB-1455316
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
QiHang Media Web (QH.aspx) Digital Signage 3.0.9 Cookie User Password Disclosure
Summary Digital Signage Software. Description The application suffers from a cleartext transmission/storage of sensitive information in a cookie. This allows a remote attacker to intercept the HTTP Cookie authentication credentials via a man-in-the-middle attack. QiHang Media Web QH.aspx Digital...
CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site Scripting
There are unauthenticated reflected Cross-Site Scripting XSS vulnerabilities in CareerUp theme, via the filter parameters. Edit WPScanTeam May 27th, 2020 - Vendor Contacted by Original Submitter. May 29th, 2020 - v2.3.0 Released. Unclear if issue fixed. June 18th, 2020 - Another submitter Vlad...
Final Tiles Gallery < 3.4.19 - Authenticated Stored Cross-Site Scripting (XSS)
Multiple cross-site scripting vulnerabilities in Final Tiles Gallery 3.4.18 and lower allow remote attackers to inject arbitrary web script or HTML via the Title and Caption fields of an image. Successful exploitation of this vulnerability would allow an authenticated high-privileged user author+...
UliCMS 2020.1 Cross Site Scripting
Exploit Title: UliCMS 2020.1 - Persistent Cross-Site Scripting Google Dork: N/A Date: 2019-03-24 Exploit Author: SunCSR Vendor Homepage: https://en.ulicms.de Software Link: https://en.ulicms.de/currentversions.html Version: 2020.1 Tested on: Windows CVE : N/A Vulnerability : Stored Cross-Site...
Ultimate Membership Pro < 8.6.1 - Multiple Critical Vulnerabilities
Multiple Critical Vulnerabilities found in Ultimate Membership Pro could leads to Authenticated using a low privilege account, such as subscriber Remote Code Execution on default Installation, as well as PII disclosure such as emails, IP addresses, hashed passwords, usernames, User-Agent and so o...