10763 matches found
PT-2022-11757 · Unknown · Novel-Plus
Name of the Vulnerable Software and Affected Versions: novel-plus versions all Description: The issue concerns an unrestricted file upload in the /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java file. This allows an attacker to upload malicious JSP files...
novel-plus 代码问题漏洞
novel-plus novel boutique-plus is a multi-end PC, WAP reading, functional original literature CMS system. Novel-plus has a file upload vulnerability, which originates from the lack of file upload restrictions in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java. An...
CVE-2022-22798
Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp...
CVE-2022-22798
Sysaid – Pro Plus Edition (v20.4.74 b10 through v22.1.30 b49) suffers a broken access control vulnerability where an attacker logged in as a guest can manipulate the URL (ending in /ConcurrentLogin%2ejsp) to access the system dashboard via EndUserPortal.JSP, potentially exposing server details, u...
CVE-2022-22798 Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control
Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp...
ManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure Exploit
Exploit Title: ManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/self-service-password/download.html Details:...
ManageEngine Access Manager Plus REST API Restriction Bypass (CVE-2022-29081)
Binary data manageengineaccessmanagerpluscve-2022-29081.nbin...
F5 NGINX Service Mesh Access Control Error Vulnerability
F5 NGINX Service Mesh F5 NSM is a fully integrated lightweight service mesh from F5 USA. Leveraging a data plane powered by NGINX Plus to manage container traffic in Kubernetes environments, F5 NGINX Service Mesh suffers from an access control error vulnerability that can be exploited by attacker...
CISA Alert: Top 15 Routinely Exploited Vulnerabilities
The U.S. Cybersecurity & Infrastructure Security Agency has published its report on the top exploited vulnerabilities of 2021. This blog summarizes the report’s findings and how you can use Qualys VMDR to automatically detect and remediate these risks in your enterprise environment. The...
Security Bulletin: Vulnerabilities in the Linux Kernel, Samba, Sudo, Python, and tcmu-runner affect IBM Spectrum Protect Plus
Summary Vulnerabilities in the Linux Kernel, Samba, Sudo, Python, and tcmu-runner such as denial of service, elevation of privileges, buffer overflow, directory traversal, information disclosure, and bypassing of security restrictions , may affect IBM Spectrum Protect Plus. UPDATE 28 January 2022...
Exploit for Code Injection in Vmware Spring_Framework
漏洞简介 最近spring爆出重磅级CVE漏洞，cve信息显示"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot...
CVE-2022-28462
novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability...
CVE-2022-28462
novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability...
Arbitrary file deletion
novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability...
CVE-2022-28462
novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability...
CVE-2022-28462
novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability...
CVE-2022-28462
CVE-2022-28462 affects novel-plus 3.6.0 with an Arbitrary file reading vulnerability caused by lack of restrictions on file parameters. NVD CVSSv3.1 base score 7.5 (HIGH) with network access and no privileges required; confidentiality impact HIGH. PT-Security notes no available fix as of their en...
PT-2022-19043 · Unknown · Novel-Plus
Name of the Vulnerable Software and Affected Versions: novel-plus version 3.6.0 Description: The issue is related to an Arbitrary file reading vulnerability. Recommendations: For novel-plus version 3.6.0, at the moment, there is no information about a newer version that contains a fix for this...
novel-plus 安全漏洞
novel-plus novel-plus is a multi-end PC, WAP reading, full-featured original literature CMS system. A security vulnerability exists in novel-plus 3.6.0, which is caused by an arbitrary file read vulnerability due to a lack of restrictions on file parameters in the application...