Command injection

In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute script...

CVE-2023-31689

In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute script...

BEAR < 1.1.3.2 - Cross-Site Request Forgery (CSRF)

The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request...

CVE-2023-31689

In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute script...

Smart App Banner < 1.1.2 - Cross-Site Request Forgery (CSRF)

The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request...

PT-2023-12998 · Fastweb · Fastweb Fastgate Mediaaccess Dga4131Fwb +1

Name of the Vulnerable Software and Affected Versions: Fastweb FASTGate MediaAccess FGA2130FWB version 18.3.n.0482 FW 230 FGA2130 Fastweb FASTGate MediaAccess DGA4131FWB versions up to 18.3.n.0462 FW 261 DGA4131 Description: A heap-based buffer overflow in a network service allows a remote attack...

The vulnerability of the application software interface of the Cisco DNA Center allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the application programming interface of the Cisco DNA Center relates to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information through a specially creat...

The vulnerability of the application software interface of the Cisco DNA Center allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the application programming interface of the Cisco DNA Center relates to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information through a specially creat...

golang: net/http, mime/multipart: denial of service from excessive resource consumption

A flaw was found in Go, where it is vulnerable to a denial of service caused by an excessive resource consumption flaw in the net/http and mime/multipart packages. By sending a specially-crafted request, a remote attacker can cause a denial of service...

The vulnerability in the web interface for managing D-Link DIR-2640-US microprogramming software allows a hacker to bypass security restrictions.

The vulnerability of the web interface for managing D-Link DIR-2640-US microprogramming software is related to deficiencies in the authentication process when processing the LoginPassword parameter. Exploiting this vulnerability allows a malicious actor to bypass security restrictions by sending ...

The vulnerability of D-Link DIR-819 router’s microprogramming software, related to improper cleaning or freeing of resources, allows a intruder to trigger a service failure.

The vulnerability of D-Link DIR-819 router’s microprogramming software is related to improper cleaning or freeing of resources. Exploiting this vulnerability can allow a malicious actor to trigger a service failure by sending a specially crafted request from the...

CVE-2023-31572

An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privileges via a crafted request...

CVE-2023-31572

An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privileges via a crafted request...

CVE-2023-29861

An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the device...

CVE-2023-29861

An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the device...

CVE-2023-29861

An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the device...

IBM Security Verify Access 输入验证错误漏洞

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. IBM Security Verify Access suffers from an input validation error vulnerability that stems from improper input validation of the application, which can be exploited by an...

The vulnerability in the phpcgi.py script of the D-Link DIR-890L A1 router’s microprogramming software allows a hacker to bypass security restrictions and restore user credentials for accessing the system.

The vulnerability of the phpcgi.py script in the D-Link DIR-890L A1 router microprogramming system is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and restore access credentials to gain entry into the...

The vulnerability of the phpcgi component in D-Link DIR-879 A1 microprogramming router software allows a hacker to bypass security restrictions and restore login credentials for accessing the system.

The vulnerability of the phpcgi component in D-Link DIR-879 A1 router microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and restore access credentials for entering the system by...

SAP BusinessObjects Platform 安全漏洞

SAP BusinessObjects Platform is a centralized suite for data reporting, visualization and sharing from SAP, Germany. A security vulnerability exists in SAP BusinessObjects Platform, which can be exploited by remote attackers to submit a special request that can be sniffed to obtain sensitive...