OCS Inventory NG 2.3.0.0 Unquoted Service Path

Exploit Title: OCS Inventory NG 2.3.0.0 - Unquoted Service Path Date: 2023/04/21 Exploit Author: msd0pe Vendor Homepage: https://oscinventory-ng.org Software Link: https://github.com/OCSInventory-NG/WindowsAgent My Github: https://github.com/msd0pe-1 Fixed in version 2.3.1.0 OCS Inventory NG...

OCS Inventory NG 2.3.0.0 - Unquoted Service Path Vulnerability

Exploit Title: OCS Inventory NG 2.3.0.0 - Unquoted Service Path Exploit Author: msd0pe Vendor Homepage: https://oscinventory-ng.org Software Link: https://github.com/OCSInventory-NG/WindowsAgent My Github: https://github.com/msd0pe-1 Fixed in version 2.3.1.0 OCS Inventory NG Windows Agent: Versio...

OCS Inventory NG 2.3.0.0 - Unquoted Service Path

Exploit Title: OCS Inventory NG 2.3.0.0 - Unquoted Service Path Date: 2023/04/21 Exploit Author: msd0pe Vendor Homepage: https://oscinventory-ng.org Software Link: https://github.com/OCSInventory-NG/WindowsAgent My Github: https://github.com/msd0pe-1 Fixed in version 2.3.1.0 OCS Inventory NG...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: stack overflow in doprocdointvec and procskipspaces CVE-2022-4378 ALSA: pcm: Move rwsem lock inside sndctlelemread to prevent UAF CVE-2023-0266 kernel: FUSE filesystem low-privileged user...

ABB Central Licensing System Improper Access Control (CVE-2020-8471)

For the Central Licensing Server component used in ABB products ABB Ability System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to...

ABB Central Licensing System Permissions, Privileges, and Access Controls (CVE-2020-8476)

For the Central Licensing Server component used in ABB products ABB Ability System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to...

ABB Central Licensing System Improper Restriction of XML External Entity Reference (CVE-2020-8479)

For the Central Licensing Server component used in ABB products ABB Ability System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to...

ABB Central Licensing System Uncontrolled Resource Consumption (CVE-2020-8475)

For the Central Licensing Server component used in ABB products ABB Ability System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to...

Nextcloud: CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link

Summary It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link. e.g. in an email, chat link, etc This vulnerability was introduced in an attempt to fix 1720043. The patch however can be bypassed and also introduced a CSRF vulnerability...

GLSA-202208-17 : Nextcloud: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202208-17 Nextcloud: Multiple Vulnerabilities - Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup server even if the user...

CVE-2021-32678

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller OCSController using the @BruteForceProtection annotation. Risk depends on the installed...

OCS Inventory NG < 2.9.2 XSS Vulnerability

OCS Inventory NG is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2021-46355

OCS Inventory 2.9.1 is affected by Cross Site Scripting XSS. To exploit the vulnerability, the attacker needs to manipulate the name of some device on your computer, such as a printer, replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting XSS...

CVE-2021-46355

OCS Inventory 2.9.1 is affected by Cross Site Scripting XSS. To exploit the vulnerability, the attacker needs to manipulate the name of some device on your computer, such as a printer, replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting XSS...

CVE-2021-46355

OCS Inventory 2.9.1 is affected by Cross Site Scripting XSS. To exploit the vulnerability, the attacker needs to manipulate the name of some device on your computer, such as a printer, replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting XSS...

Cross site scripting

OCS Inventory 2.9.1 is affected by Cross Site Scripting XSS. To exploit the vulnerability, the attacker needs to manipulate the name of some device on your computer, such as a printer, replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting XSS...

CVE-2021-46355

OCS Inventory 2.9.1 is affected by Cross Site Scripting XSS. To exploit the vulnerability, the attacker needs to manipulate the name of some device on your computer, such as a printer, replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting XSS...

CVE-2021-46355

OCS Inventory NG 2.9.1 is affected by a Cross Site Scripting (XSS) vulnerability where a attacker may inject code by manipulating a device name (e.g., a printer), enabling stored XSS. The issue is documented across multiple sources (NVD/Red Hat/OpenVAS); the root cause is improper handling of dev...

PT-2022-12666

Name of the Vulnerable Software and Affected Versions OCS Inventory version 2.9.1 Description The issue affects OCS Inventory, allowing an attacker to exploit a Cross Site Scripting XSS vulnerability. To exploit this, the attacker must manipulate the name of a device, such as a printer, by...

Ocs Inventory 跨站脚本漏洞

Ocs Inventory is an asset management solution from Ocs. It enables users to take inventory of It assets. A security vulnerability exists in OCS Inventory 2.9.1, which can be exploited by an attacker who manipulates the names of certain devices on your computer, such as printers, by replacing the...