The microweber application allows large characters to insert in the input field "SKU" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber

Go to add post http://site.com/admin/product/create click on create new product There will a option called SKU Fill the input field with huge characters, more than 1 lakh Copy the below payload and put it in the input fields and click on continue. You will see the application accepts large...

The microweber application allows large characters to insert in the input field "Leave comment" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber

Proof of Concept 1. Go to http://site/admin/view:content/action:posts 2. Create a page and enable to add comment option 3. Go to that page and there will a option called "Leave a comment" 4. Copy the below payload and put it in the "Leave a comment" field post a comment 5. Go to...

The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber

Proof of Concept 1. Go to http://127.0.0.1/admin/view:modules/loadmodule:users/action:profile 2. Click on edit profile 3. Fill the first name & last name field with huge characters, more than 1 lakh 4. Copy the below payload and put it in the input fields and click on continue. 5. You will see th...

The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

Proof of Concept 1. Go to add post http://site.com/admin/post/create 2. click on create new post 3. There will a option called post title 4. Fill the input field with huge characters, more than 1 lakh 5. Copy the below payload and put it in the input fields and click on continue. 6. You will see...

PT-2022-1828

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication versions 9.5U3 through 9.5U4, 10.x, and 11.x Description An improper limitation of path names allows remote authenticated users to access internal API functions. This access could allow attackers to upload and execut...

Server-Side Request Forgery (SSRF)

Description The SSRF Protection is incomplete and can be bypassed via an HTTP redirect, the python-requests library will follow redirections by default can be disabled byallowredirects=False. An attacker can set up their HTTP server to respond with a 302 redirect to redirect the request to...

PT-2022-16746 · Unknown +4 · Autofile Audio File Library +4

Name of the Vulnerable Software and Affected Versions: audiofile version 0.3.6 Description: A memory leak vulnerability exists in the printfileinfo function within printinfo.c of the audiofile Audio File Library. This allows an attacker to leak sensitive information by processing a crafted file...

PT-2022-1466 · Phpipam · Phpipam

Name of the Vulnerable Software and Affected Versions: PhpIPAM version 1.4.4 Description: The issue is related to the lack of protection against SQL query structure manipulation when handling the subnet parameter in the app/admin/routing/edit-bgp-mapping-search.php component of the phpipam web...

PT-2021-8031 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.4 Description: A use-after-free vulnerability has been identified in the Linux kernel. The issue arises when the ipv4 mib exit net function is called before tcp sk exit batch during the destruction of a net...

PT-2021-4363 · Moxa · Moxa Mxview Network Management

Name of the Vulnerable Software and Affected Versions: Moxa MXview Network Management software versions 3.x through 3.2.2 Description: The issue is related to insufficient access control in the Moxa MXView network control software, which can be exploited by a remote attacker to bypass security...

PT-2021-10414 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2018 Description: A remote code execution issue in the template user.php file allows attackers to execute arbitrary PHP code. This is achieved via the ml and title parameters. Recommendations: For ZZCMS version 2018, consider...

PT-2021-4760 · Adobe +4 · Xmp Toolkit Sdk +4

Name of the Vulnerable Software and Affected Versions: XMP Toolkit SDK versions 2020.1 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker could leverage this vulnerability to bypass mitigations such a...

CVE-2021-22779

Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, SCADAPack...

PT-2021-10736 · Unknown · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Hospital Management System version 4.0 Description: The issue concerns a SQL injection vulnerability located in the hmsregistration.php file. This vulnerability can be exploited by remote unauthenticated users to obtain sensitive...

PT-2021-17565 · Sap · Abap Platform +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver ABAP Server and ABAP Platform Enqueue Server versions 7.22, 7.22EXT, 7.49, 7.53, 7.73, 8.04 Description: The issue allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet ov...

PT-2021-17563 · Sap · Abap Platform +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver ABAP Server and ABAP Platform Dispatcher versions 7.22 through 7.83 Description: The issue allows an unauthenticated attacker to send a specially crafted packet over a network, triggering an internal error in the system due to...

PT-2021-17567 · Sap · Sap Netweaver Abap Server

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver ABAP Server and ABAP Platform Enqueue Server versions 7.22, 7.22EXT, 7.49, 7.53, 7.73 SAP NetWeaver ABAP Server and ABAP Platform Enqueue Server version 8.04 Description: The issue allows an unauthenticated attacker without...

PT-2021-14403 · Dynamoose · Dynamoose

Name of the Vulnerable Software and Affected Versions: Dynamoose versions 2.0.0 through 2.6.0 Description: Dynamoose is an open-source modeling tool for Amazon's DynamoDB. A prototype pollution vulnerability was found in the internal utility method lib/utils/object/set.ts, which is used throughou...

PT-2021-11344 · Softmaker · Softmaker Office Planmaker 2021

Name of the Vulnerable Software and Affected Versions: SoftMaker Office PlanMaker 2021 Revision 1014 Description: A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used fo...

PT-2020-13605 · Lantronix · Xport Edge

Name of the Vulnerable Software and Affected Versions: Lantronix XPort EDGE versions 3.0.0.0R11 through 4.2.0.0R7 Description: An information disclosure issue exists in the Web Manager and telnet CLI functionality. A specially crafted HTTP request can cause information disclosure. An attacker can...