46 matches found
PT-2022-3878 · Robustel · Robustel R1510
Name of the Vulnerable Software and Affected Versions: Robustel R1510 version 3.3.0 Description: The issue is related to command injection vulnerabilities in the web server action endpoints functionalities. A specially-crafted network request can lead to arbitrary command execution. The...
Exploit for Code Injection in Vmware Spring_Framework
Spring Framework RCE exploitation Quick pentest notes...
NeDi SQL Injection Vulnerability (CNVD-2021-22163)
NeDi is an open source software tool that discovers, maps and inventories network devices and tracks connected end nodes. A SQL injection vulnerability exists in the Monitoring History function in endpoint /Monitoring-History.php in NeDi 1.9C. An attacker can exploit this vulnerability to access...
Grab: Registration enabled on ███grab.com
Summary: An attacker can register an account on the █████████grab.com service, and access information from the service Description: While logging in via Google accounts is prohibited, an attacker can register an account through the /login/create endpoint, as per the below request POST /login/crea...
CVE-2018-1051
It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via Yaml.load in YamlProvider. Mitigation If the YamlProvider is enabled its recommended to add authentication, and authorization to the endpoint expecting...