SA45653 - Cross-site Request Forgery in Login Form

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. In a login CSRF attack, the attacker forges a login request to an honest site using the attacker’s username and password at that site. If the forgery succeeds, the honest server...

Ice Hrm Session Fixation Vulnerability

Ice Hrm is a human resource management system. Ice Hrm suffers from a session fixation vulnerability. An attacker can exploit the vulnerability to hijack a valid user session via a specially crafted session cookie...

There are logic flaws and vulnerabilities in the IoT smart water meter supervisory platform of Shandong KD Electronics Co.

Ltd. is a national high-tech enterprise and national high-tech zone gazelle enterprise integrating product development, production, sales and teaching practice. There is a logic flaw vulnerability in the Internet of Things IoT Smart Water Meter Supervision Platform of Shandong KDE Electronics Co...

DEBIAN-CVE-2021-31826

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable for a daemon crash on systems not using this feature if a crafted cookie is supplied...

HDHCMS has a logic flaw vulnerability

HDHCMS is an all-in-one self-service station building management system based on PC website + mobile website + WeChat small program + third-party platform access WeChat public number, Xiongpang number. HDHCMS has a logic flaw vulnerability. An attacker can exploit the vulnerability by constructin...

IBM BigFix Inventory Code Issue Vulnerability

IBM BigFix Inventory is a suite of solutions for software control and security risk mitigation from IBM USA. A security vulnerability exists in versions prior to IBM BigFix Inventory v10.0.2 that stems from a failure to set a security flag for a session cookie in an https session, which could...

Wordpress limit-login-attempts-reloaded cross-site scripting vulnerability

Wordpress limit-login-attempts-reloaded is a Wordpress Foundation plugin that provides login restrictions for Wordpress. The plugin provides platform administrators with login restriction policies to safeguard account security as well as platform stability. A security vulnerability exists in...

XSS Vulnerability in Shanghai Niomai Network Technology Co.

Ltd. is a software company focusing on serving small and medium-sized courier and logistics enterprises. With a deep understanding of the current situation and development direction of the management and service of Chinese and foreign courier and logistics enterprises, the company has created a...

D-Link Central WiFi Manager (CWM-100) Remote Code Execution Vulnerability

D-Link Central WiFi Manager CWM-100 is a Web-based wireless access point management tool that enables you to create and manage multi-site, multi-tenant wireless networks. A remote code execution vulnerability exists in /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM-100...

CVE-2018-19437

CVE-2018-19437 affects UCMS 1.4.7. The vulnerability allows remote authenticated users to change the administrator password via cookie-based authentication: $COOKIE['admin '.cookiehash] can be set to arbitrary non-empty values. This is the root cause and leads to admin access compromise. CVSS det...

Schneider Electric U.motion Builder Remote Code Execution Vulnerability (CNVD-2018-07819)

U.motion Builder is a builder product from Schneider Electric France. A remote code execution vulnerability exists in the publicly available applet on the Schneider Electric U.motion Builder web service. Since the underlying SQLite database query is affected by the logininfo parameter which can b...

ATCOM PBX Authentication Bypass

Title: ATCOM PBX system , auth bypass exploit Author: i-Hmx contact : [email protected] Home : sec4ever.com Tested on : ATCOM IP01 , IP08 , IP4G and ip2G4A Details The mentioned system is affected by auth bypass flaw that allow an attacker to get admin access on the vulnerable machine without...

SDCMS后台绕过直接进入,一种不常见的设计失误案例

简要描述： SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试 详细说明： Islogin //判断登录的方法 sub islogin if sdcms.strlenadminid=0 or sdcms.strlenadminname=0 then dim t0,t1,t2 t0=sdcms.getintsdcms.loadcookie"adminid",0 loadcookie t1=sdcms.loadcookie"islogin" t2=sdcms.loadcookie"loginkey" if sdcms.strlent0=0 or...

XSS vulnerability in BXR

Vulnerability ID: HTB22507 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinbxr1.html Product: BXR Vendor: Hulihan Applications ;http://hulihanapplications.com/projects/bxr Vulnerable Version: 0.6.8 and Probably Prior Versions Vendor Notification: 22 July 2010 Vulnerability Type: XSS...

Webspell 4 SQL Injection

Webspell Login Bypass Found by: h0yt3r Checklogin.php Line 60: setcookie"wsauth", $ds'userID'.":".$wspwd, time+$sessionduration6060; $login = 1; functions.php Line 253: $loginpercookie = false; ifisset$COOKIE'wsauth' AND !isset$SESSION'wsauth' $loginpercookie = true; $SESSION'wsauth' =...

webSPELL 4 - Authentication Bypass

webSPELL 4 - Authentication Bypass Webspell Login Bypass Found by: h0yt3r Checklogin.php Line 60: setcookie"wsauth", $ds'userID'.":".$wspwd, time+$sessionduration6060; $login = 1; functions.php Line 253: $loginpercookie = false; ifisset$COOKIE'wsauth' AND !isset$SESSION'wsauth' $loginpercookie =...

Webspell 4 (Auth Bypass) SQL Injection Vulnerability

No description provided by source. Webspell Login Bypass Found by: h0yt3r Checklogin.php Line 60: setcookie"wsauth", $ds'userID'.":".$wspwd, time+$sessionduration6060; $login = 1; functions.php Line 253: $loginpercookie = false; ifisset$COOKIE'wsauth' AND !isset$SESSION'wsauth' $loginpercookie =...

webSPELL 4 - Authentication Bypass

Webspell Login Bypass Found by: h0yt3r Checklogin.php Line 60: setcookie"wsauth", $ds'userID'.":".$wspwd, time+$sessionduration6060; $login = 1; functions.php Line 253: $loginpercookie = false; ifisset$COOKIE'wsauth' AND !isset$SESSION'wsauth' $loginpercookie = true; $SESSION'wsauth' =...

MYBBS系统存在漏洞

1.用户注册功能页面没有针对无用户名注册的过滤用户注册功能页面没有针对用户名的长度的过滤用户注册功能页面没有针对无密码用户的过滤用户注册功能页面没有针对用户签名以及个人介绍的字数限制用户注册功能页面没有针对用户头像大小以及规格的限制 2.论坛版面最新回复所调用字数的限制论坛版面发表新文章的主题字数限制论坛版面发表新文章内容部分的字数限制论坛版面发表新文章针对JS的过滤 3.论坛短信功能页面没有针对发表人以及回复人的限制论坛短信功能页面对于JS恶意代码的过滤（JS代码嵌入漏洞论坛短信功能页面没有针对发表后页面的时间限制（可以导致无限制短信DOS...

eazyportal-sql.txt

!/usr/bin/perl Vendor url: http://www.eazyportal.com/ by Iron - http://www.randombase.com exploit goes through $COOKIE use LWP::UserAgent; use MIME::Base64; print " EazyPortal ; if$target ! /^http:/// $target = "http://".$target; if$target ! //$/ $target .= "/"; print "User id to retrieve...