Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

Summary EnvironmentManager.listBackups reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups later passes that trusted entry.path directly to rmSyncentry.path, recursive: true, force: true . An attacker who can place or modify a manifest inside...

Netmaker Virtual Network Authentication Bypass

The vulnerability of Netmaker’s virtual network platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

EUVD-2022-46033

Malicious code in bioql PyPI...

CVE-2024-11060

CVE-2024-11060 affects Jinher Network Collaborative Management Platform 1.0. The vulnerability is an SQL injection in an unknown function of /C6/JHSoft.Web.AcceptAip/AcceptShow.aspx/, triggered by manipulating the id parameter. It is exploitable remotely, and public exploits exist according to th...

CVE-2024-21618 Junos OS and Junos OS Evolved: When LLDP is enabled and a malformed LLDP packet is received, l2cpd crashes

An Access of Memory Location After End of Buffer vulnerability in the Layer-2 Control Protocols Daemon l2cpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause Denial of Service DoS. On all Junos OS and Junos OS Evolved platforms, when LLDP is...

Discussion On Kontackt 1.18 Cross Site Scripting

==================================================================================================================================== | Title : Discussion on Kontackt - The Exclusive PHP Social Network Platform v1.18 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pr...

Sql injection

WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=search&s=recipients...

CVE-2022-42984: Improper Neutralization of Special Elements used in an SQL Command

WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=search&s=recipients...

PT-2022-26694

Name of the Vulnerable Software and Affected Versions WoWonder Social Network Platform version 4.1.4 Description The issue is related to a SQL injection vulnerability. It can be exploited via the offset parameter at the "requests.php?f=search&s=recipients" endpoint. Recommendations For WoWonder...

PT-2022-25369

Name of the Vulnerable Software and Affected Versions WoWonder Social Network Platform version 4.1.2 Description The issue is related to a SQL injection vulnerability. It can be exploited via the offset parameter at the "requests.php?f=load-my-blogs" endpoint. Recommendations For WoWonder Social...

CVE-2022-40405

CVE-2022-40405 affects WoWonder Social Network Platform v4.1.2 and is due to a SQL injection vulnerability in the offset parameter of requests.php?f=load-my-blogs. The CVSS 3.1 base score is 7.5 (High), with network attack vector, no privileges required, no user interaction, and a confidentiality...

CVE-2022-40405: Improper Neutralization of Special Elements used in an SQL Command

WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs...

PT-2022-17745

Name of the Vulnerable Software and Affected Versions WoWonder The Ultimate PHP Social Network Platform version 4.0.0 Description The issue allows unauthenticated attackers to arbitrarily change group ID names due to an access control problem. Recommendations For WoWonder The Ultimate PHP Social...

CVE-2022-26254: Authorization Bypass Through User-Controlled Key

WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names...

WoWonder Social Network Platform 3.1 - Authentication Bypass

Exploit Title: WoWonder Social Network Platform 3.1 - Authentication Bypass Date: 11.06.2021 Exploit Author: securityforeveryone.com Researchers : Security For Everyone Team - https://securityforeveryone.com Vendor Homepage: https://www.wowonder.com/ Software Link:...

Cisco IOx RCE

The vulnerability of the Cisco IOx software platform for the Cisco IOS XE operating system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow a remote attacker to enhance their privileges and execute arbitrary code...

ONAP HOLMES Code Injection Vulnerability

ONAP HOLMES is an analytical application for DCAE Data Collection, Analysis and Events Subsystem from the ONAP project. A code injection vulnerability exists in previous versions of ONAP HOLMES Dublin. An attacker could exploit this vulnerability by accessing port 9202 of the dep-holmes-engine-mg...

Cisco Webex Bug Allows Remote Code Execution

Cisco Systems has fixed two high-severity vulnerabilities in its products, including one in its popular Webex video conferencing platform that could enable a remote attacker to execute commands. The high-severity Webex flaw exists in the web-based management interface of Cisco Webex Video Mesh, a...

3 Critical Bugs Allow Remote Attacks on Cisco NX-OS and Switches

Cisco Systems has issued patches for three critical vulnerabilities impacting a key tool for managing its network platform and switches. The bugs could allow an unauthenticated, remote attacker to bypass endpoint authentication and execute arbitrary actions with administrative privileges on...

iSocial 1.2.0 - Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications Exploit Title: iSocial 1.2.0 - Cross-Site Scripting / Cross-Site Request Forgery Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/isocial-social-network-platform/21164041?srank=2 Version: 1.2.0 Tested on: Kali...