703 matches found
Cisco Webex Meetings and Webex Meetings Server Input Validation Error Vulnerability
Cisco WebEx Meetings Server CWMS and Cisco Webex Meetings are both products of Cisco Cisco, U.S.A. Cisco WebEx Meetings Server is a multi-functional conferencing solution that includes audio, video, and Web conferencing in the WebEx Meetings program. Cisco Webex Meetings is a video conferencing...
Code injection
An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can accept a URL, to which users will be redirected after a successful login. In conjunction with CVE-2019-12784, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site,...
CVE-2020-12875
Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks. An authenticated user could gain unauthorized access to sensitive information or functionality by manipulating specific parameters within the application...
CVE-2019-4446
IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 163490...
Subex ROC Partner Settlement Insecure Direct Object Reference (IDOR) Vulnerability
Subex ROC Partner Settlement is a scalable partner management platform from Subex India. The platform supports features such as billing and revenue management. A security vulnerability exists in the Change Password feature in Subex ROC Partner Settlement version 10.5. The vulnerability can be...
CVE-2020-9384
An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the applicati...
CVE-2020-3922
LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation...
CVE-2020-3922
CVE-2020-3922 affects LisoMail by ArmorX. The vulnerability is an SQL injection via a URL parameter manipulation that allows attackers to access the database without authentication. According to the supplied data, CVSS vectors indicate a NETWORK attack with HIGH/CRITICAL impact (CVSS v3.1: 9.8; c...
CVE-2020-3922 ArmorX LisoMail - SQL Injection
LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation...
Cross site scripting
Multiple cross-site request forgery CSRF and cross-site scripting XSS vulnerabilities in Axous 1.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add an administrator account via an addnew action to admin/administratorsadd.php; or 2 conduct...
CVE-2015-3423
Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 ctrl, 2 h%2427, 3 h%2439, 4 param0, 5 param1, 6 param2, 7 param3, 8 param4, 9 filterINSERTCOUNT, 10 filterMINORFALLOUT, 11...
CVE-2019-17604
An Insecure Direct Object Reference IDOR vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidates' personal information first name, last name, email, CV, phone number, and all other personal information by changing the value of the candidate id the id...
CVE-2019-15810
The CVE-2019-15810 entry concerns Netdisco 2.042010, where insufficient sanitization during the device search allows a reflected XSS via manipulation of a URL parameter. The root cause is inadequate input sanitization in the search path; the impact is a reflected cross-site scripting vulnerabilit...
CVE-2019-15810
Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter...
The vulnerability of the eLearning Server 4G system in terms of access control deficiencies allows an intruder to gain access to the user’s file storage.
The vulnerability of the eLearning Server 4G system for managing learning and development is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access to the user’s file storage by replacing the parameters of the current user’s identifie...
CVE-2013-7467
Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...
CVE-2019-9063
PHP Scripts Mall Auction website script 2.0.4 allows parameter tampering of the payment amount...
Sql injection
upload/protected/modules/admini/views/post/index.php in BageCMS through 3.1.4 allows SQL Injection via the title or titleAlias parameter...
LongBox Limited Access Manager Insecure Direct Object Reference
Exploit Title: Access Manager Unauthenticated Insecure Direct Object Reference IDOR Google Dork: /runJob.html?jobId= Date: 01/22/2019 Exploit Author: 0v3rride Vendor Homepage: https://docs.logonbox.com/index.html Software Link: N/A Version: = 1.2 = 1.2 = 1.4-RG4. PoC examples:...
