7943 matches found
PT-2024-21919 · Wmcms · Wmcms
Name of the Vulnerable Software and Affected Versions: WMCMS version 4.4 Description: An issue in the DelFile function allows attackers to delete arbitrary files via a crafted POST request. Recommendations: For WMCMS version 4.4, consider disabling the DelFile function until a patch is available ...
CVE-2024-27489
An issue in the DelFile function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request...
The vulnerability of the fromNatlimit function (/goform/Natlimit) in the Tenda F1202 router microprogramming system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the fromNatlimit function /goform/Natlimit in the Tenda F1202 router microprogramming system is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected informatio...
The vulnerability of the fromqossetting (/goform/fromqossetting) function in the Tenda F1202 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the fromqossetting /goform/fromqossetting function in the Tenda F1202 router software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information by...
CVE-2024-38446
NATO NCI ANET 3.4.1 mishandles report ownership. A user can create a report and, despite the restrictions imposed by the UI, change the author of that report to an arbitrary user without their consent or knowledge via a modified UUID in a POST request...
CVE-2024-6807
CVE-2024-6807 affects SourceCodester Student Study Center Desk Management System 1.0. The vulnerability exists in the HTTP POST handler at /sscdms/classes/Users.php?f=save, where manipulating the arguments firstname, middlename, lastname, or username triggers a cross-site scripting (XSS) flaw. Th...
PT-2024-28006 · Nato · Nato Nci Anet
Name of the Vulnerable Software and Affected Versions: NATO NCI ANET version 3.4.1 Description: The issue concerns mishandling of report ownership. A user can create a report and change its author to any arbitrary user without their consent or knowledge. This is achieved by modifying the UUID in ...
CVE-2024-38446
NATO NCI ANET 3.4.1 mishandles report ownership. A user can create a report and, despite the restrictions imposed by the UI, change the author of that report to an arbitrary user without their consent or knowledge via a modified UUID in a POST request...
PT-2024-37878 · Sourcecodester · Sourcecodester Student Study Center Desk Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Student Study Center Desk Management System version 1.0 Description: A vulnerability was found in the system, classified as problematic, affecting some unknown functionality of the file /sscdms/classes/Users.php?f=save of the...
CVE-2024-38446
CVE-2024-38446 concerns NATO NCI ANET 3.4.1. The vulnerability allows an attacker to create a report and, by altering a UUID in a POST request, change the report author to an arbitrary user without their consent. This is a logic/authorization issue where report ownership is mishandled. Affected c...
Geoserver Unauthenticated Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Geoserver unauthenticated Remote Code Execution', 'Description' = %q GeoServer is an open-source software server written in Java that provides th...
CVE-2024-39181
Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a buffer overflow via the ApCliSsid parameter in thegenerateconfrouter function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...
CVE-2023-3290 A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0
A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...
CVE-2023-3286 A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0
A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user secretary in the system. This results in unauthorized data manipulation...
CVE-2024-39181
Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a buffer overflow via the ApCliSsid parameter in thegenerateconfrouter function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...
The vulnerability of the formQosManageDouble_user() function in the Tenda W9 wireless access point software allows a intruder to execute arbitrary code or cause a service failure.
The vulnerability of the formQosManageDoubleuser function in the Tenda W9 wireless access point software is related to buffer overflow based on a stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause a service failure by sending a specially crafted POST...
CVE-2024-37769
Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...
CVE-2024-37769
CVE-2024-37769 affects 14Finger v1.1 due to insecure permissions that allow a normal user to escalate to Administrator via a crafted POST request. Exploitation details beyond the described crafted POST are not provided in the connected documents. The impact is privilege escalation; no remediation...