CVE-2018-7079: Incorrect Authorization

Aruba ClearPass Policy Manager guest authorization failure. Certain administrative operations in ClearPass Guest do not properly enforce authorization rules, which allows any authenticated administrative user to execute those operations regardless of privilege level. This could allow low-privileg...

Damon database suffers from an override modification process vulnerability (CNVD-2018-03645)

DM7 is a new-generation database product designed by Damon on the basis of summarizing the R&D and application experience of DM series products, absorbing the advantages of mainstream database products, and adopting JAVA-like virtual machine technology. DM7 database has the loophole of oversteppi...

CVE-2017-5260

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference DRO at...

Buffer overflow

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

ProjectSend r754 - Insecure Direct Object Reference Vulnerability

Exploit for php platform in category web applications Document Title: =============== ProjectSend r754 - IDOR & Authentication Bypass Vulnerability Product & Service Introduction: =============================== ProjectSend is a self-hosted application you can install it easily on your own VPS or...

Windows NDProxy Privilege Escalation XP SP3 x86 and 2003 SP2 x86 (MS14-002) Exploit

NDPROXY is a system-provided driver that interfaces WAN miniport drivers, call managers, and miniport call managers to the Telephony Application Programming Interfaces TAPI services. The vulnerability is caused when the NDProxy.sys kernel component fails to properly validate input. An attacker wh...

ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities

Exploit for multiple platform in category web applications Document Title: =============== ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities Product & Service Introduction: =============================== SupportCenter Plus is a web-based customer support software that lets...

EMC Documentum D2 Information Disclosure Vulnerability

EMC Documentum D2 is an enterprise document management software. The EMC Documentum D2-API formation logs passwords and user credentials that are used to encrypt D2 sensitive systems using MD5 hashes recorded to log files, where low-privileged users can obtain the MD5 hashes and perform malicious...

Oracle存在多个安全漏洞

CNCAN ID：CNCAN-2009041604 多个Oracle产品存在漏洞，可导致SQL注入，泄漏敏感信息或使攻击者破坏系统： -Oracle Process Manager和Notification opmn守护程序存在格式串错误，提交特殊构建的POST请求给port 6000/TCP可导致任意代码执行。 -传递给"DBMSAQIN"的输入在使用前缺少过滤，可导致注入任意SQL代码。 -Oracle数据库包含的Application Express组件存在错误，非特权用户可以获得"LOWS030000.WWVFLOWUSER"中的APEX密码HASH。 目前还存在多个未知漏洞。...