10216 matches found
NotificationX < 2.3.12 - Unauthenticated SQLi
The plugin does not validate and escape the id parameter in its notificationx/v1/notification REST endpoint before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL Injection attacks. The apikey is the md5 of the homeurl either with http or https protocol...
WordPress WP Free SSL – Free SSL Certificate for WordPress and force HTTPS plugin < 1.2.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Free SSL – Free SSL Certificate for WordPress and force HTTPS plugin versions 1.2.7. Solution Update the WordPress WP Free SSL – Free SSL Certificate for WordPress and force HTTPS plugin to the late...
WordPress WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content plugin < 5.7.11 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content plugin versions 5.7.11. Solution Update the WordPress WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix...
Cobbler <= 3.3.3 Unsafe Protocol Vulnerability
Cobbler is prone to an unsafe protocol usage vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
Shopify: Bypass of fix #1370749
Hello team, on report 1370749 the reporter found that the preview link is not expiring. So when someone will gain access to the preview link, he can access it for whole life as the preview link remains the same even after changing the storefont password. I have reported the issue 1401525 where i ...
(Pwn2Own) Cisco RV340 Firmware Update Improper Certificate Validation Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Cisco RV340 routers. User interaction is required to exploit this vulnerability in that an administrator must perform a firmware update on the device. The specific flaw exists within the...
Cobbler has an unspecified vulnerability (CNVD-2022-18326)
Cobbler is a network installation server suite that is primarily used to quickly build Linux network installation environments. a security vulnerability exists in Cobbler that stems from routines in some files that use the HTTP protocol instead of the more secure HTTPS. no details of the...
FileCloud 21.2 Cross Site Request Forgery
Exploit Title: FileCloud 21.2 - Cross-Site Request Forgery CSRF Date: 2022-02-20 Exploit Author: Masashi Fujiwara Vendor Homepage: https://www.filecloud.com/ Software Link: https://hub.docker.com/r/filecloud/filecloudserver21.2 Version: All versions of FileCloud prior to 21.3 Fiexd: version...
Ruby on Rails Information Disclosure Vulnerability (GHSA-rmj8-8hhh-gv5h) - Linux
Ruby on Rails is prone to an information disclosure vulnerability in puma. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...
FileCloud 21.2 - Cross-Site Request Forgery Vulnerability
Exploit Title: FileCloud 21.2 - Cross-Site Request Forgery CSRF Date: 2022-02-20 Exploit Author: Masashi Fujiwara Vendor Homepage: https://www.filecloud.com/ Software Link: https://hub.docker.com/r/filecloud/filecloudserver21.2 Version: All versions of FileCloud prior to 21.3 Fiexd: version...
CVE-2021-45081
An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS...
CVE-2021-45081
An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS...
Design/Logic Flaw
An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS...
CVE-2021-45081
An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS...
CVE-2021-45081
An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS...
CVE-2021-45081
An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS...
CVE-2021-45081
CVE-2021-45081 affects Cobbler up to version 3.3.1. The issue is that routines expose HTTP instead of HTTPS, enabling potential eavesdropping or MITM on management/API endpoints. The connected documents confirm the root cause but do not specify a patched version or explicit mitigation in the prov...
PT-2022-12302
Name of the Vulnerable Software and Affected Versions Cobbler versions prior to 3.3.2 Description An issue was discovered where routines in several files use the HTTP protocol instead of the more secure HTTPS. Recommendations For Cobbler versions prior to 3.3.2, consider updating to a version tha...
CVE-2022-0666: Improper Neutralization of CRLF Sequences
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11...
(Pwn2Own) Samsung Galaxy S21 Improper Error Handling Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Samsung Galaxy S21 phones. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the handling of errors...