Booking Core 跨站请求伪造漏洞

Booking Core is a software application. A Laravel-based booking system designed for travel websites, shopping malls, travel agencies, tour operators, B&Bs, villa rentals, resort rentals, Make Travel websites. Booking Core suffers from a cross-site request forgery vulnerability that stems from...

PT-2021-3545

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the lack of protection for the web page structure in the MDT server of the SAP NetWeaver software integration platform. Exploitation of this issue could allow a...

PT-2021-3543

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the ProxyServer of the SAP NetWeaver software integration platform, where the structure of web pages is not properly protected. This can be exploited by a remote...

PT-2021-3547

Name of the Vulnerable Software and Affected Versions SAP Business Objects affected versions not specified Description The issue is related to the lack of protection of the web page structure in the SAP Business Objects decision support system. Exploitation of this issue could allow a remote...

PT-2021-3546

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the Ecatt server of the SAP NetWeaver platform, where the structure of web pages is not properly protected. This can be exploited by a remote attacker using a...

CVE-2021-30116

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...

Authentication flaw

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...

CVE-2021-30116: Insufficiently Protected Credentials

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...

Backdoor.Win32.Zombam.l Buffer Overflow

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/9729e9fc004ea49d3c2ddee28736dae3.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.l Vulnerability: Remote Stack Buffer Overflow Description: Zombam malware...

Ubuntu: Security Advisory (USN-4998-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-20583

IBM Security Verify IBM Security Verify Privilege Vault 10.9.66 could disclose sensitive information through an HTTP GET request by a privileged user due to improper input validation.. IBM X-Force ID: 199396...

CVE-2021-20583

IBM Security Verify IBM Security Verify Privilege Vault 10.9.66 could disclose sensitive information through an HTTP GET request by a privileged user due to improper input validation.. IBM X-Force ID: 199396...

PT-2021-14056

Name of the Vulnerable Software and Affected Versions: IBM Security Verify version 10.9.66 Description: The issue could allow disclosure of sensitive information through an HTTP GET request by a privileged user due to improper input validation. Recommendations: For IBM Security Verify version...

Validation Bypass

neos/form has validation bypass. An attacker is able to input a malicious crafted 'GET' request and bypass invoking any validators...

Form validation can be skipped

Impact By crafting a special GET request containing a valid form state, a form can be submitted without invoking any validators. We consider the severity low because it is not possible to change any form values since the form state is secured with an HMAC that is still verified. That means that...

CVE-2021-32697 Form validation can be skipped

neos/forms is an open source framework to build web forms. By crafting a special GET request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form...

CVE-2021-32697

neos/forms is an open source framework to build web forms. By crafting a special "GET" request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if For...

Form validation can be skipped in neos/form

Impact By crafting a special GET request containing a valid form state, a form can be submitted without invoking any validators. We consider the severity low because it is not possible to change any form values since the form state is secured with an HMAC that is still verified. That means that...

Neos/forms 输入验证错误漏洞

Neos/forms is an open source framework for building web forms. A security vulnerability exists in Neos/forms where the program can submit a form without invoking any validator by creating a special "GET" request that contains valid form state...

PT-2021-19863

Name of the Vulnerable Software and Affected Versions neos/forms versions prior to the version containing the fix for this issue Description The issue allows a form to be submitted without invoking any validators by crafting a special GET request containing a valid form state. The form state is...