Privilege Escalation

github.com/hashicorp/vault is vulnerable to privilege escalation. An underlying database file associated with the Integrated Storage feature are insecurely opened with excessive permissions...

Hashicorp HashiCorp Vault 安全特征问题漏洞

Hashicorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. HashiCorp Vault suffers from a security signature issue vulnerability that arises from the product not adding valid access permissions to an underlying database file. An attacker could use this...

Design/Logic Flaw

Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA all versions, EcoStruxure Geo SCADA Expert 2019 all versions, and EcoStruxure Geo SCADA Expert 2020 V83.7742.1 and prior, which could cause the revealing of account credentials when server database file...

libmaxminddb: Denial of service

Background The libmaxminddb library provides a C library for reading MaxMind DB files, including the GeoIP2 databases from MaxMind. Description libmaxminddb used uninitialised memory when reading from a corrupt database file. Impact A remote attacker could entice a user to use a specially crafted...

grafana: information disclosure through world-readable /var/lib/grafana/grafana.db

An information-disclosure flaw was found in the way Grafana set permissions for the database directory and file. This flaw allows a local attacker access to potentially sensitive information such as cleartext or encrypted datasource passwords from /var/lib/grafana/grafana.db...

Travel Management System 1.0 Remote Code Execution

Exploit Title: Travel Management System v1.0 - Unauthenticated Remote Code Execution Exploit Author: Adeeb Shah @hyd3sec & Bobby Cooke boku Vulnerability Discovery: Adeeb Shah @hyd3sec Date: August 10, 2020 Vendor Homepage: https://projectworlds.in/ Software Link:...

Travel Management System 1.0 Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Travel Management System v1.0 - Unauthenticated Remote Code Execution Exploit Author: Adeeb Shah @hyd3sec & Bobby Cooke boku Vulnerability Discovery: Adeeb Shah @hyd3sec Date: August 10, 2020 Vendor Homepage:...

PbootCMS suffers from an information disclosure vulnerability (CNVD-2020-33162)

PbootCMS is an open source free PHP enterprise web development and construction management system. PbootCMS has an information leakage vulnerability that can be exploited by attackers to obtain database file information...

Information disclosure

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information e.g., cleartext or encrypted datasource passwords...

UBUNTU-CVE-2020-12458

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information e.g., cleartext or encrypted datasource passwords...

Memory Corruption Vulnerability in MagicWorks HMI V3.91 at Shenzhen Hexin Automation Technology Co.

Ltd. abbreviated as "Hexin Technology", founded in 2003, is a high-tech enterprise specializing in the research and development, production, sales and technical services of industrial automation products, and is a supplier of industrial automation solutions. MagicWorks HMI V3.91 has a memory...

h2: Information Exposure due to insecure handling of permissions in the backup

An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files outside of their permissions via a symlink to a fake database file...

CVE-2019-14709

A cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The file in question is /usr/local/ipsca/mipsca.db. If a camera is compromised, the attacker can gain access to passwords and abuse them to compromise further systems...

MicroDigital N-series cameras trust management issue vulnerability

MICRODIGITAL N-series cameras is a N-series network camera from MICRODIGITAL in Korea. A trust management issue vulnerability exists in the /usr/local/ipsca/mipsca.db file in MicroDigital N-series cameras using firmware version 6400.0.8.5 and earlier, which can be exploited by an attacker to gain...

Authentication flaw

Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the database backup file name. A malicious actor can exploit this issue to download the database file and disclose login...

CVE-2019-2517

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 18c. Easily exploitable vulnerability allows high privileged attacker having DBFSROLE privilege with network access via Oracle Net to compromise Core RDBMS. While the...

Tina4 Stack 1.0.3 - SQL Injection / Database File Download Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Tina4 Stack 1.0.3 - SQL Injection / Database File Download Exploit Author: Ihsan Sencan Vendor Homepage: http://tina4.com/ Software Link: https://ayera.dl.sourceforge.net/project/tina4stack/v1.0.3/Release%20V1.0.3.zip Version:...

Maitra Mail Tracking System 1.7.2 - SQL Injection / Database File Download Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Maitra - Mail Tracking System 1.7.2 - SQL Injection / Database File Download Exploit Author: Ihsan Sencan Vendor Homepage: http://salzertechnologies.com/ Software Link:...

Tina4 Stack 1.0.3 SQL Injection

Exploit Title: Tina4 Stack 1.0.3 - SQL Injection / Database File Download Dork: N/A Date: 2018-11-09 Exploit Author: Ihsan Sencan Vendor Homepage: http://tina4.com/ Software Link: https://ayera.dl.sourceforge.net/project/tina4stack/v1.0.3/Release%20V1.0.3.zip Version: 1.0.3 Category: Webapps Test...

Tina4 Stack 1.0.3 - SQL Injection / Database File Download

Exploit Title: Tina4 Stack 1.0.3 - SQL Injection / Database File Download Dork: N/A Date: 2018-11-09 Exploit Author: Ihsan Sencan Vendor Homepage: http://tina4.com/ Software Link: https://ayera.dl.sourceforge.net/project/tina4stack/v1.0.3/Release%20V1.0.3.zip Version: 1.0.3 Category: Webapps Test...