Denial Of Service (DoS)

php is vulnerable to denial of service DoS. The vulnerability exists as it was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large...

Denial Of Service (DoS)

jbossws-common is vulnerable to denial of service DoS. The vulnerability exists as it was found that JBoss Web Services Native did not properly protect against recursive entity resolution when processing Document Type Definitions DTD. A remote attacker could exploit this flaw by sending a...

CVE-2020-11597

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request and inject SQL statements in the user context of the db owner...

Hardcoded credentials

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leveraged to send emails from a customer trusted email address...

CVE-2020-11593

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leveraged to send emails from a customer trusted email address...

CVE-2020-11597

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request and inject SQL statements in the user context of the db owner...

CVE-2020-11593: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leveraged to send emails from a customer trusted email address...

PT-2020-12709

Name of the Vulnerable Software and Affected Versions CIPPlanner CIPAce version 9.1 Build 2019092801 Description An issue allows an unauthenticated attacker to make an HTTP POST request with injected HTML data. This injected data is later used to send emails from a customer's trusted email addres...

PT-2020-12713

Name of the Vulnerable Software and Affected Versions CIPPlanner CIPAce version 9.1 Build 2019092801 Description An issue allows an unauthenticated attacker to make an HTTP POST request and inject SQL statements in the user context of the db owner. Recommendations For CIPPlanner CIPAce version 9....

CVE-2020-11597: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request and inject SQL statements in the user context of the db owner...

Apache Solr 8.3.0 Velocity Template Remote Code Execution Exploit

This Metasploit module exploits a vulnerability in Apache Solr versions 8.3.0 and below which allows remote code execution via a custom Velocity template. Currently, this module only supports Solr basic authentication. From the Tenable advisory: An attacker could target a vulnerable Apache Solr...

Fedora 30 : coturn (2020-f3fcb1608a)

An exploitable heap overflow vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. - An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server...

PT-2020-4985

Name of the Vulnerable Software and Affected Versions КТС «Маяк» affected versions not specified Description The issue is related to the lack of protection for the SQL query structure in the web interface. This could allow a remote attacker to execute arbitrary SQL commands using a specially...

PT-2020-4986

Name of the Vulnerable Software and Affected Versions КТС «Маяк» affected versions not specified Description The issue is related to the lack of protection for the SQL query structure in the web interface. This could allow a remote attacker to execute arbitrary SQL commands using a specially...

PT-2020-4988

Name of the Vulnerable Software and Affected Versions КТС «Маяк» affected versions not specified Description The issue is related to the lack of protection for the SQL query structure in the web interface. This could allow a remote attacker to execute arbitrary SQL commands using a specially...

PT-2020-4984

Name of the Vulnerable Software and Affected Versions КТС «Маяк» affected versions not specified Description The issue is related to the lack of protection for the SQL query structure in the web interface. This could allow a remote attacker to execute arbitrary SQL commands using a specially...

PT-2020-4995

Name of the Vulnerable Software and Affected Versions КТС «Маяк» affected versions not specified Description The issue is related to the lack of protection for the SQL query structure in the web interface. This could allow a remote attacker to execute arbitrary SQL commands using a specially...

CVE-2019-9509

The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected XSS in an HTTP POST parameter. The web application does not neutralize user-controllable input before displaying to users in a web page, which could allow a remote attacker authenticated with a user accou...

Cross site scripting

The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected XSS in an HTTP POST parameter. The web application does not neutralize user-controllable input before displaying to users in a web page, which could allow a remote attacker authenticated with a user accou...

CVE-2019-9509 The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected cross site scripting

The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected XSS in an HTTP POST parameter. The web application does not neutralize user-controllable input before displaying to users in a web page, which could allow a remote attacker authenticated with a user accou...