1694 matches found
squid: Improper input validation in request allows for proxy manipulation
A flaw was found in squid. The absolute URL of a request can include the decoded UserInfo username and password for certain protocols. This decoded info may contain special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a...
Arbitrary File Deletion
wordpress is vulnerable to Arbitrary File Deletion. Insecure validation of the meta key protection in isprotectedmeta in wp-includes/meta.php allows an attacker to delete arbitrary files on the host...
CVE-2020-28032
WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php...
CVE-2020-28036
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post...
CVE-2020-28039
isprotectedmeta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected...
CVE-2020-28032: Deserialization of Untrusted Data
WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php...
CVE-2020-28039: Undefined Security Weakness
isprotectedmeta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected...
CVE-2020-28036: Missing Authorization
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post...
CVE-2020-28037: Improper Check for Unusual or Exceptional Conditions
isbloginstalled in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution as well as a denial of service for the old installation...
Sql injection
An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the usernameavailable function of the includes/functions.php file which is called by login.php...
CVE-2020-27886
An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the usernameavailable function of the includes/functions.php file which is called by login.php...
CVE-2020-27886: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the usernameavailable function of the includes/functions.php file which is called by login.php...
PT-2020-16825
Name of the Vulnerable Software and Affected Versions EyesOfNetwork eonweb versions 5.3-7 through 5.3-8 Description The issue is related to a SQL injection in the eonweb web interface, allowing an unauthenticated attacker to exploit the username available function of the includes/functions.php...
lookn4u.com Cross Site Scripting vulnerability OBB-1428481
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-25132: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending the improper variable type Array allows a bypass of core SQL Injecti...
CVE-2020-25147: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via username0 to the default URI, because of...
PT-2020-15983
Name of the Vulnerable Software and Affected Versions Observium Professional, Enterprise & Community version 20.8.10631 Description The issue allows for SQL Injection due to the possibility of injecting malicious SQL statements in malformed parameter types. This can occur via the username0...
PT-2020-15968
Name of the Vulnerable Software and Affected Versions Observium Professional, Enterprise & Community version 20.8.10631 Description An issue in Observium allows SQL Injection due to the possibility of injecting malicious SQL statements through malformed parameter types. Specifically, sending an...
CVE-2020-25286: Undefined Security Weakness
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...
CVE-2020-24572: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured and virtually unrestricted web console to attack the underlying OS Raspberry Pi running this software, and execute commands on the system including ones for uploading o...