171160 matches found
Pega Infinity - Authentication Bypass
Pega Infinity versions 8.2.1 through 8.5.2 contain an authentication bypass vulnerability because the password reset functionality for local accounts can be used to bypass local authentication checks. id: CVE-2021-27651 info: name: Pega Infinity - Authentication Bypass author: idealphase,daffainf...
Apache ShenYu Admin JWT - Authentication Bypass
Apache ShenYu 2.3.0 and 2.4.0 allow Admin access without proper authentication. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. id: CVE-2021-37580 info: name: Apache ShenYu Admin JWT - Authentication Bypass author: pdteam severity: critical descriptio...
Cisco IOS HTTP Configuration - Authentication Bypass
HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL. id: CVE-2001-0537 info: name: Cisco IOS HTTP Configuration - Authentication Bypass author:...
SolarView 6.00 - Remote Command Execution
SolarView Compact 6.00 is vulnerable to a command injection via networktest.php. id: CVE-2022-40881 info: name: SolarView 6.00 - Remote Command Execution author: For3stCo1d severity: critical description: | SolarView Compact 6.00 is vulnerable to a command injection via networktest.php. impact: |...
Codoforum 5.1 - Arbitrary File Upload
Codoforum 5.1 contains an arbitrary file upload vulnerability via the logo change option in the admin panel. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code. As a result, an attacker can potentially obtain...
Jira - Incorrect Authorization
Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access. id: CVE-2019-3403...
MetInfo 7.0.0 beta - SQL Injection
MetInfo 7.0.0 beta is susceptible to SQL injection via the admin/?n=language&c=languagegeneral&a=doSearchParameter appno parameter a different issue than CVE-2019-16997. id: CVE-2019-17418 info: name: MetInfo 7.0.0 beta - SQL Injection author: ritikchaddha severity: high description: | MetInfo...
Oracle Business Intelligence - Path Traversal
Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher formerly XML Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. id: CVE-2019-2588 info: name: Oracle Business Intelligence - Path...
Nagios 5.5.6-5.7.5 - Authenticated Remote Command Injection
Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php. This in turn can lead to remot...
WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery
WordPress PhonePe Payment Solutions plugin through 1.0.15 is susceptible to server-side request forgery. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized...
rConfig 3.9.4 - SQL Injection
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10547 info: nam...
Ghost CMS - User Enumeration
Ghost CMS 5.9.4 contains a user enumeration vulnerability in the login functionality. The application reveals whether a user account exists through different error messages, allowing attackers to enumerate valid user accounts via specially-crafted HTTP requests. id: CVE-2022-41697 info: name: Gho...
snyk-js-jquery-565129
يحتوي هذا المستودع على التصحيحات لـ CVE-2020-11022 و CVE-2020-11023 والتي تؤثر على جميع إصدارات jQuery قبل 3.5.0، بما في ذلك التصحيحات من DanielRuf/snyk-js-jquery-174006. تم إنشاء هذه التصحيحات باستخدام diff -u original patched patchfile. تطبيق التصحيحات يمكنك تطبيق التصحيحات باستخدام patch و git...
snyk-js-jquery-174006
يحتوي هذا المستودع على التصحيحات الخاصة بـ CVE-2019-11358 - ثغرة تلويث النموذج الأولي والتي تؤثر على جميع إصدارات jQuery قبل 3.4.0. تم إنشاء هذه التصحيحات باستخدام diff -u original patched patchfile. تطبيق التصحيحات يمكنك تطبيق التصحيحات باستخدام patch, git apply, patch-package و composer-patches...
Log4jPatch
-- تم أرشفة هذا المستودع -- سيستمر التطوير الإضافي لهذه الأداة في corretto/hotpatch-for-apache-log4j2. شكرًا للمشاركة والتعليق والتجربة والمساهمة في هذا المشروع! Log4jPatch هذا إثبات مفهوم POC لأداة بسيطة تحقن وكيل Java في عملية JVM قيد التشغيل. سيقوم الوكيل بتصحيح طريقة lookup لجميع مثيلات...
CVE-2022-30190_Temporary_Fix_Source_Code
🩹إصلاح مؤقت لـ CVE-2022-30190🩹 الكود المصدري هذه هي الأكواد المصدريّة لاثنين من سكربتات بايثون التي تم تجميعها لتطبيق حماية مؤقتة بسهولة وسرعة ضد ثغرة CVE-2022-30190 Follina يمكن برمجتها بشكل أفضل، لكن هذا فقط لتنفيذها بأسرع وقت ممكن وقد فعلتها بدون معرفة كبيرة ببايثون، لكن الجزء المهم هو... إنها...
Vulnerability-Management
Rapport de gestion des vulnérabilités Préparé pour : CyberTech Solutions Préparé par : Victoria Simon Date : 10 avril 2024 1. Résumé exécutif Ce rapport présente les résultats d'une évaluation complète des vulnérabilités réalisée sur l'infrastructure Linux et les applications web de CyberTech...
PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass
Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass Summary praisonai-platform lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For...
