579 matches found
PT-2021-21095 · Digi · Digi Realport
Name of the Vulnerable Software and Affected Versions: Digi RealPort versions through 4.8.488.0 Description: The issue concerns the 'encrypted' mode of Digi RealPort, which is susceptible to man-in-the-middle attacks due to a lack of authentication. Recommendations: For versions through 4.8.488.0...
Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS
Impact URL to the payment page done after checkout was created with autoincremented payment id /pay-with-paypal/id and therefore it was easy to access for anyone, not even the order's customer. The problem was, the Credit card form has prefilled "credit card holder" field with the Customer's firs...
CVE-2021-39194
kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in...
The vulnerability of microprogrammed programmable logic controllers like Modicon and PacDrive lies in the lack of authentication for a critical function. This allows attackers to alter the device’s IP configuration.
The vulnerability of the microprogrammed logic controllers Modicon and PacDrive lies in the absence of authentication for the critical function. Exploiting this vulnerability allows an attacker to remotely alter the device’s IP configuration...
The vulnerability in the web interface of the Cisco Identity Services Engine allows a perpetrator to execute arbitrary code and disclose protected information.
The vulnerability in the web interface of the Cisco Identity Services Engine exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and disclose sensitive information...
CVE-2021-32688
Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications e.g. DAV sync clients, and can also be configured by the user to not have any...
The vulnerability in the web administration panel of Netgear ProSafe Plus JGS516PE and ProSAFE Plus GS116Ev2 microprogrammed network devices allows a hacker to perform cross-site scripting attacks.
The vulnerability of the web administration panel of Netgear ProSafe Plus JGS516PE and ProSAFE Plus GS116Ev2 networking devices is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...
The vulnerability of the samba networking interaction software library smbd lies in the lack of privilege control mechanisms and access management tools. This allows attackers to compromise data integrity.
The vulnerability of the samba networking interaction software library smbd is related to the lack of mechanisms for privilege control and access management. Exploiting this vulnerability allows an attacker to compromise data integrity...
CASAP Automated Enrollment SQL Injection Vulnerability
CASAP Automated Enrollment is an automated enrollment system organized by CASAP USA. The purpose of this project is to provide an automated enrollment system for CASAP to streamline the school process and make it more effective, efficient, and easily retrievable. A SQL injection vulnerability...
The vulnerability of the central/executar_login.php component of the Mk-Auth authentication software allows a hacker to execute arbitrary SQL queries against the database.
The vulnerability of the central/executarlogin.php component of the Mk-Auth authentication software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the database in the target...
Rock RMS Security Vulnerability
Rock RMS is a church management system. Versions of Rock RMS prior to 8.6 have a security vulnerability. An attacker could easily take over an account by tampering with the user id parameter in the profile update. Due to the lack of authentication and the use of consecutive user ids, any user can...
The vulnerability of the Modbus terminal protocol implementation in the EKRA 200 microprocessor series allows a hacker to execute any Modbus command and alter the controller’s configuration, including modifying the control program and executing arbitrary code.
The vulnerability of the Modbus microprogramming software for ECUs exists due to the lack of authentication for any Modbus protocol commands. Exploiting this vulnerability allows a malicious actor to execute any Modbus command remotely and alter the controller’s configuration, including modifying...
The vulnerability of microprogrammed storage software for Intel SSDs lies in the lack of protection for operational data, allowing attackers to gain unauthorized access to protected information.
The vulnerability of microprogrammed solid-state storage devices like Intel SSDs lies in the lack of protection for operational data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...
The vulnerability of the Tricon Communications Module, related to the lack of protection for operational data, allows attackers to disclose the protected information.
The vulnerability of the Tricon Communications Module is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...
The vulnerability of the CAMS for HIS distributed control systems’ emergency message and event management component allows a intruder to unauthorizedly interact with the server.
The vulnerability of the CAMS for HIS distributed control systems’ emergency message and event management component is related to the lack of authentication during interactions via a specialized protocol. Exploiting this vulnerability allows an attacker to perform unauthorized interactions with t...
The vulnerability of the Infrastructure component of the Oracle Financial Services Analytical Applications Infrastructure software allows a perpetrator to carry out a cross-site scenario attack.
The vulnerability of Oracle Financial Services Analytical Applications Infrastructure’s component is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow a malicious actor to perform a cross-site scenario attack remotely...
DEBIAN-CVE-2020-17448
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension...
sangga.jipmani.com Cross Site Scripting vulnerability OBB-1217358
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
The vulnerability of the GetInstalledPackages function in the Application Lifestyle Management installation manager allows a malicious individual to gain unauthorized access to confidential data, cause service failures, or compromise data integrity.
The vulnerability of the GetInstalledPackages function in the Application Lifestyle Management installation manager is related to the lack of mechanisms for privilege control and access management. Exploiting this vulnerability could allow an attacker to gain unauthorized access to confidential...
