Genius Bytes Genius Server usrInternalUsrCRUD plugin elevation of privilege vulnerability

Genius Bytes Genius Server is a set of data platforms for connecting IT infrastructure components from Genius Bytes Germany. usrInternalUsrCRUD is one of the internal user CRUD Create, Read, Update and Delete plug-ins. A security vulnerability exists in the usrInternalUsrCRUD plugin in Genius Byt...

CVE-2020-10879

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

CVE-2020-10879

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

Command injection

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

CVE-2018-10465

Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...

CVE-2018-10465

CVE-2018-10465 affects Jamf Pro 10.x before 10.3.0, where users with login access had full CRUD rights to the Universal API (UAPI) endpoints, regardless of privileges. Root cause: Incorrect Access Control allowing unauthorized information disclosure, compromised data integrity, and potential data...

rConfig < 3.9.3 Multiple RCE Vulnerabilities - Version Check

rConfig is prone to multiple remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2019-16663

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution...

Cross-site Scripting (XSS)

backpack/crud is vulnerable to cross-site scripting XSS. The vulnerability exists as the attributes in the select field of select.blade.php was not sanitized...

CVE-2018-20962

The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type...

CVE-2018-20962

CVE-2018-20962 affects Backpack\CRUD for Laravel (component Backpack) prior to 3.4.9. The vulnerability is an XSS via the select field type, caused by unsanitized attributes in the select.blade.php implementation. Affected ecosystem: Laravel-based Backpack\CRUD, with public references confirming ...

MailEnable vulnerability warning CVE-2019-12923~CVE-2019-12927-the vulnerability warning-the black bar safety net

Recently, the mail server MailEnable broke a set of vulnerabilities, the first time for tracking and analysis of early warning. The study found that, using the set of vulnerabilities that an attacker can achieve the user data CRUD, the file is read and a portion of the override operation...

Influxdb authentication bypass vulnerability alerts-a vulnerability alert-the black bar safety net

0x00 vulnerability background 2019 5 December 31, 360CERT monitoring to the @Moti Harmats in Komodosec released InfluxDB database authentication bypass vulnerability details. A malicious attacker can easily obtain a complete database of control permissions, you can optionally perform CRUD...

[SECURITY] Fedora 29 Update: drupal7-entity-1.9-1.fc29

This module extends the entity API of Drupal core in order to provide a uni fied way to deal with entities and their properties. Additionally, it provides an entity CRUD controller, which helps simplifying the creation of new entity types. This package provides the following Drupal modules: entit...

[SECURITY] Fedora 30 Update: drupal7-entity-1.9-1.fc30

This module extends the entity API of Drupal core in order to provide a uni fied way to deal with entities and their properties. Additionally, it provides an entity CRUD controller, which helps simplifying the creation of new entity types. This package provides the following Drupal modules: entit...

Laundry CMS - Multiple Vulnerabilities

=========================================================================================== Exploit Title: Laundry CMS clothcode SQL Inj. Dork: N/A Date: 09-03-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://laundry.rpcits.co.in/ Software Link: https://sourceforge.net/projects/laundr...

Node.js third-party modules: [@azhou/basemodel] SQL injection

I would like to report SQL injection in @azhou/basemodel It allows attacker to read data from database. Module module name: @azhou/basemodel version: 1.0.0 npm page: https://www.npmjs.com/package/@azhou/basemodel Module Description Usage Initialization js var model =...

Grocery crud 1.6.1 - 'search_field' SQL Injection

Exploit Title: Grocery crud 1.6.1 - 'searchfield' SQL Injection Google Dork: n/a Date: 2018-11-05 Exploit Author: Loading Kura Kura Vendor Homepage: https://www.grocerycrud.com/ Software Link: https://www.grocerycrud.com/downloads Version: 1.6.1 Tested on: Win10/Kali Linux CVE : 1. Proof of Conce...

Cross site request forgery (csrf)

An issue was discovered in Juunan06 eCommerce through 2018-08-05. There is a CSRF vulnerability in ee/eBoutique/app/template/includes/crudTreatment.php that can add new users and add products...

GHSA-VFP9-GWRH-WQ9G Path Traversal in crud-file-server

Versions of crud-file-server prior to 0.9.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 0.9.0 or later...