Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

Summary EnvironmentManager.listBackups reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups later passes that trusted entry.path directly to rmSyncentry.path, recursive: true, force: true . An attacker who can place or modify a manifest inside...

The vulnerability of Netmaker’s virtual network platform, related to deficiencies in authentication procedures, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of Netmaker’s virtual network platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

EUVD-2022-46033

Malicious code in bioql PyPI...

CVE-2024-11060

CVE-2024-11060 affects Jinher Network Collaborative Management Platform 1.0. The vulnerability is an SQL injection in an unknown function of /C6/JHSoft.Web.AcceptAip/AcceptShow.aspx/, triggered by manipulating the id parameter. It is exploitable remotely, and public exploits exist according to th...

CVE-2024-21618 Junos OS and Junos OS Evolved: When LLDP is enabled and a malformed LLDP packet is received, l2cpd crashes

An Access of Memory Location After End of Buffer vulnerability in the Layer-2 Control Protocols Daemon l2cpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause Denial of Service DoS. On all Junos OS and Junos OS Evolved platforms, when LLDP is...

Discussion On Kontackt 1.18 Cross Site Scripting

==================================================================================================================================== | Title : Discussion on Kontackt - The Exclusive PHP Social Network Platform v1.18 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pr...

Sql injection

WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=search&s=recipients...

CVE-2022-40405: Improper Neutralization of Special Elements used in an SQL Command

WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs...

CVE-2022-42984: Improper Neutralization of Special Elements used in an SQL Command

WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=search&s=recipients...

CVE-2022-40405

CVE-2022-40405 affects WoWonder Social Network Platform v4.1.2 and is due to a SQL injection vulnerability in the offset parameter of requests.php?f=load-my-blogs. The CVSS 3.1 base score is 7.5 (High), with network attack vector, no privileges required, no user interaction, and a confidentiality...

CVE-2022-26254: Authorization Bypass Through User-Controlled Key

WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names...

WoWonder Social Network Platform 3.1 - Authentication Bypass

Exploit Title: WoWonder Social Network Platform 3.1 - Authentication Bypass Date: 11.06.2021 Exploit Author: securityforeveryone.com Researchers : Security For Everyone Team - https://securityforeveryone.com Vendor Homepage: https://www.wowonder.com/ Software Link:...

The vulnerability of the Cisco IOx software platform for the Cisco IOS XE operating system allows a hacker to escalate their privileges and execute arbitrary code.

The vulnerability of the Cisco IOx software platform for the Cisco IOS XE operating system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow a remote attacker to enhance their privileges and execute arbitrary code...

ONAP HOLMES Code Injection Vulnerability

ONAP HOLMES is an analytical application for DCAE Data Collection, Analysis and Events Subsystem from the ONAP project. A code injection vulnerability exists in previous versions of ONAP HOLMES Dublin. An attacker could exploit this vulnerability by accessing port 9202 of the dep-holmes-engine-mg...

Cisco Webex Bug Allows Remote Code Execution

Cisco Systems has fixed two high-severity vulnerabilities in its products, including one in its popular Webex video conferencing platform that could enable a remote attacker to execute commands. The high-severity Webex flaw exists in the web-based management interface of Cisco Webex Video Mesh, a...

3 Critical Bugs Allow Remote Attacks on Cisco NX-OS and Switches

Cisco Systems has issued patches for three critical vulnerabilities impacting a key tool for managing its network platform and switches. The bugs could allow an unauthenticated, remote attacker to bypass endpoint authentication and execute arbitrary actions with administrative privileges on...

iSocial 1.2.0 - Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications Exploit Title: iSocial 1.2.0 - Cross-Site Scripting / Cross-Site Request Forgery Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/isocial-social-network-platform/21164041?srank=2 Version: 1.2.0 Tested on: Kali...

Vulnerability of Universal Password Login in Changmeng Network Website Building Platform

Changmeng Network is a website building platform developed by Guangzhou Xingmeng Animation Design Co. There exists a universal password login vulnerability in the website building platform. Attackers can utilize this vulnerability to log in to the background management page without password...

SQL Injection Vulnerability in MZD Web Platform of Changsha Spring Culture Communication Co.

MZD network platform software is Spring's set of years of practical experience in diskless network and the actual needs of customers, independent research and development completed a server/client mode operation, to provide professional diskless guidance services for the client's management...

Telecom's Campus Network Common Management Platform Has Overstepping Vulnerabilities

Telecom Campus Network Common Management Platform is a set of telecom campus network of China Telecom Group Corporation serving colleges and universities. An override vulnerability exists in the Telecom Campus Network Common Management Platform. The system fails to correctly verify user privilege...