CVE-2022-1155

Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...

CVE-2022-1155 Old sessions are not blocked by the login enable function. in snipe/snipe-it

Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...

CVE-2022-0680

The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plzconfigurationtrackerenable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue...

WordPress plugin Social Sharing Plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the...

Old sessions are not blocked by the login enable function.

Description If you disable logic function of an user, that user can still login by using their old session. Proof of Concept Step 1: login to dashboard by a normal account. Step 2: use a diffrent browser to login as admin Step 3: make the normal account in step 1 unable to login. Step 4: return t...

Nextcloud: Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic

Summary: add summary of the vulnerability Steps To Reproduce: 1. Create a Call as User A Moderator 2. Add User B to the call 3. Start the call as User A 4. User B joins the call and enables the camera 5. User A removes all permissions for User B, cam and mic are now disabled 6. User A grants all...

CVE-2022-1003

One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads...

Internet Bug Bounty: Use of uninitialized value of in req_parsebody method of lua_request.c

Software Versions Ubuntu - 18.04 64-bit Apache 2.4.51 - 64 bit Cause of Bug This bug is present in the reqparsebody method of luarequest.c file. Below mentioned lines of code cause this bug. cpp const char data; int i; sizet vlen = 0; sizet len = 0; if luareadbodyr, &data, aprofft &size,...

CVE-2022-25816

Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable without authentication...

CVE-2022-25816

Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable without authentication...

Samsung Lock and mask apps setting 授权问题漏洞

Samsung Lock and mask apps setting is a secure application from Samsung South Korea. It is used to block apps or lock apps. A security vulnerability exists in Samsung Lock and mask apps setting that allows an attacker to change the enable/disable settings without authentication...

GSD-2022-1000503 arm64: dts: meson-sm1-odroid: use correct enable-gpio pin for tf-io regulator

arm64: dts: meson-sm1-odroid: use correct enable-gpio pin for tf-io regulator This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.10 by commit...

GSD-2022-1000425 arm64: dts: meson-sm1-odroid: use correct enable-gpio pin for tf-io regulator

arm64: dts: meson-sm1-odroid: use correct enable-gpio pin for tf-io regulator This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.24 by commit...

D-Link Dir-823-Pro Command Injection Vulnerability (CNVD-2022-15177)

D-Link Dir-823-Pro is a dual-band smart wireless router from China Youxun D-Link. D-Link DIR-823-Pro v1.0.2 contains a command injection vulnerability, which can be exploited by attackers to execute arbitrary commands via the stationaccessenable parameter...

GSD-2022-1000249 usb: xhci-plat: fix crash when suspend if remote wake enable

usb: xhci-plat: fix crash when suspend if remote wake enable This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.19 by commit...

The vulnerability of the implementation of the SetStationSettings() function in D-Link DIR-823-Pro wireless router software allows a hacker to execute arbitrary commands.

The vulnerability of the implementation of the SetStationSettings function in the microprogrammed software for D-Link DIR-823-Pro wireless routers is related to insufficient cleaning of input data during the processing of the stationaccessenable parameter. Exploiting this vulnerability allows a...

SQLRecon - A C# MS SQL Toolkit Designed For Offensive Reconnaissance And Post-Exploitation

A C MS-SQL toolkit designed for offensive reconnaissance and post-exploitation. For detailed usage information on each technique, refer to the wiki. Usage You can grab a copy of SQLRecon from the releases page. Alternatively, feel free to compile the solution yourself This should be as straight...

CVE-2021-46455

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStationSettings. This vulnerability allows attackers to execute arbitrary commands via the stationaccessenable parameter...

CVE-2021-46455

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStationSettings. This vulnerability allows attackers to execute arbitrary commands via the stationaccessenable parameter...

D-Link Dir-823-Pro 命令注入漏洞

D-Link Dir-823-Pro is a dual-band smart wireless router from China Youxun D-Link. D-Link DIR-823-Pro v1.0.2 contains a command injection vulnerability, which can be exploited by attackers to execute arbitrary commands via the stationaccessenable parameter...