D-Link DIR-809 缓冲区错误漏洞

A buffer overflow vulnerability exists in the D-Link DIR-809, a dual-band router from D-Link, China, which stems from the failure of the sub8003183C function in the product/fromLogin link to effectively determine data boundaries. An attacker could cause a buffer overflow resulting in a denial of...

Advanced Comment System 1.0 - Remote Command Execution Exploit

Exploit Title: Advanced Comment System 1.0 - Remote Command Execution RCE Exploit Author: Nicole Daniella Murillo Mejias Version: Advanced Comment System 1.0 Tested on: Linux !/usr/bin/env python3 DESCRIPTION: Commands are Base64 encoded and sent via POST requests to the vulnerable application, t...

Advanced Comment System 1.0 Remote Command Execution

Exploit Title: Advanced Comment System 1.0 - Remote Command Execution RCE Date: November 30, 2021 Exploit Author: Nicole Daniella Murillo Mejias Version: Advanced Comment System 1.0 Tested on: Linux !/usr/bin/env python3 DESCRIPTION: Commands are Base64 encoded and sent via POST requests to the...

Advanced Comment System 1.0 - Remote Command Execution (RCE)

Exploit Title: Advanced Comment System 1.0 - Remote Command Execution RCE Date: November 30, 2021 Exploit Author: Nicole Daniella Murillo Mejias Version: Advanced Comment System 1.0 Tested on: Linux !/usr/bin/env python3 DESCRIPTION: Commands are Base64 encoded and sent via POST requests to the...

Snipe-IT Cross-site Request Forgery Vulnerability

Snipe-IT is an open source IT asset/license management system. Snipe-IT is vulnerable to cross-site request forgery, which stems from a lack of csrf checksum for POST requests in the software's view.blade.php file, and can be exploited by attackers to launch cross-site request forgery attacks...

Snipe-IT 跨站请求伪造漏洞

Snipe-IT is an open source IT asset/license management system. Snipe-IT is vulnerable to cross-site request forgery, which stems from a lack of csrf checksum for POST requests in the software's view.blade.php file, and can be exploited by attackers to launch cross-site request forgery attacks...

The vulnerability of the automated information system “Registration in OO” arises from the lack of measures taken to protect the structure of the web page, allowing attackers to read arbitrary files.

The vulnerability of the automated information system “Registration in OO” is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to remotely read arbitrary files by sending a specially crafted POST request...

The vulnerability of the Content Library component of the VMware vCenter Server management tool allows a attacker to perform an SSRF attack.

The vulnerability of the Content Library component in the VMware vCenter Server management tool is related to insufficient verification of URL addresses. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack using a specially created POST request...

PT-2021-22902 · Sap · Sap Internet Communication Framework

Name of the Vulnerable Software and Affected Versions: SAP Internet Communication framework ICM versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785 Description: The issue allows an attacker with logon functionality to exploit the authentication function. This can be done...

VMware vCenter Server Server-Side Request Forgery Vulnerability

Vmware VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. vCenter Server is vulnerable to...

Vmware VMware vCenter Server 代码问题漏洞

Vmware VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. vCenter Server is vulnerable to...

CVE-2021-38412

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to...

Authentication flaw

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to...

Fortinet FortiManager Licensing Issue Vulnerability

Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and...

Fortinet FortiManager 授权问题漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and...

The vulnerability of the userLogin parameter in the rConfig configuration management utility allows a hacker to obtain confidential information.

The vulnerability of the userLogin parameter in the rConfig configuration tool exists because special elements are not properly eliminated. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information through modified POST requests...

Fortinet FortiManager 代码注入漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and...

CVE-2021-36352

Stored cross-site scripting XSS vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST requests in /modules/registrationadmission/patientregister.php page with "namemiddle", "addrstr", "station", "namemaiden", "name2", "name3" parameters...

Cross site scripting

Stored cross-site scripting XSS vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST requests in /modules/registrationadmission/patientregister.php page with "namemiddle", "addrstr", "station", "namemaiden", "name2", "name3" parameters...

CVE-2021-36352

CVE-2021-36352 : Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. The issue arises from POST requests to /modules/registration_admission/patient_register.php that include parameters such as name_middle, addr_str, station, name_maiden, name_2, an...