CVE-2020-10506

CVE-2020-10506 affects the School Manage System (before 2020) by ALLE INFORMATION CO., LTD. The vulnerability is a Path Traversal flaw that allows an attacker to access arbitrary files. The NVD entry lists a CVSSv3 base score of 7.5 (HIGH) , with network attack vector and no privileges required, ...

CVE-2020-10506 ALLE INFORMATION CO., LTD. School Manage System - Path Traversal

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Path Traversal, allowing attackers to access arbitrary files...

CVE-2020-10505

Summary (CVE-2020-10505): The School Manage System by ALLE INFORMATION CO., LTD. prior to 2020 contains an SQL Injection vulnerability that can be exploited via a union-based query to disclose database schema and credentials (username/password). Affected component: the School Manage System’s SQL ...

JVN#89224521: Multiple vulnerabilities in EasyBlocks IPv6

EasyBlocks IPv6 provided by Plat'Home Co., Ltd. contains multiple vulnerabilities listed below. Cross site request forgeryCWE-352 - CVE-2020-5549 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N| Base Score: 4.3 CVSS v2| AV:N/AC:H/Au:N/C:N/I:P/A:N| Base...

CVE-2020-3934

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command...

CVE-2020-3935

CVE-2020-3935 concerns Taiwan SECOM’s Door Access Control and Personnel Attendance Management system, where user information is stored in cleartext in cookies, exposing passwords to attackers. The NVD and related records assign a CVSSv3.1 base score of 7.5 (HIGH) with NETWORK attack vector and no...

CVE-2020-3934 TAIWAN SECOM CO., LTD. - Pre-auth SQL Injection

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command...

CVE-2020-3933: Undefined Security Weakness

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system...

PT-2020-17809

Name of the Vulnerable Software and Affected Versions TAIWAN SECOM CO., LTD. Door Access Control and Personnel Attendance Management system affected versions not specified Description The system allows attackers to enumerate and examine user accounts, potentially leading to unauthorized access or...

PT-2020-17811

Name of the Vulnerable Software and Affected Versions TAIWAN SECOM CO., LTD. Door Access Control and Personnel Attendance Management system affected versions not specified Description The system stores users' information in cleartext in the cookie, which allows attackers to obtain passwords...

PT-2020-17810

Name of the Vulnerable Software and Affected Versions TAIWAN SECOM CO., LTD. Door Access Control and Personnel Attendance Management system affected versions not specified Description The system contains a pre-authentication SQL injection issue, allowing attackers to inject specific SQL commands...

CVE-2020-3934: Improper Neutralization of Special Elements used in an SQL Command

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command...

CVE-2020-3935: Cleartext Storage of Sensitive Information

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges password to attackers...

JVN#94435544: Movable Type vulnerable to cross-site scripting

Movable Type provided by Six Apart Ltd. contains a cross-site scripting vulnerability CWE-79 in block editor and rich text editor. Impact An arbitrary script may be executed on the logged in user's web browser. Solution Update the Software Update to the latest version according to the information...

WordPress RegistrationMagic plugin <= 4.6.0.1 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Spider Sec Ltd. in WordPress RegistrationMagic plugin versions = 4.6.0.1. Solution Update the WordPress RegistrationMagic plugin to the latest available version at least 4.6.0.3...

WordPress Calculated Fields Form plugin <= 1.0.353 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Ben Armstrong Spider Sec Ltd in WordPress Calculated Fields Form plugin versions = 1.0.353. Solution Update the WordPress Calculated Fields Form plugin to the latest available version at least 1.0.354...

JVN#65280626: Movable Type vulnerable to open redirect

Movable Type provided by Six Apart Ltd. contains an open redirect vulnerability CWE-601. Impact When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack. Solution Update the Software Update the...

Trint Ltd: SSO bypass in zendesk using trint organization able to leak internal ticket information

Summary hello there because in app.trint.com there's no email verification i able to login in your zendesk SSO using your organization your organization using domain @trint.com because there's no email verification i able to read and takeover + claim this email [email protected] and i able to...

JVN#45633549: Library Information Management System LIMEDIO vulnerable to open redirect

Library Information Management System LIMEDIO provided by RICOH COMPANY, LTD. contains an open redirect vulnerability CWE-601. Impact When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack. Solutio...

V-SOL GPONEPON OLT Platform 2.03 - Cross-Site Request Forgery

V-SOL GPONEPON OLT Platform 2.03 - Cross-Site Request Forgery Exploit Title: V-SOL GPON/EPON OLT Platform 2.03 - Cross-Site Request Forgery Author: LiquidWorm Discovery Date: 2019-09-26 Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd. Product web page: https://www.vsolcn.com Tested on...