Pimcore XSS Vulnerability

Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions...

GHSA-276R-24XQ-HWG8 Pimcore XSS Vulnerability

Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions...

CVE-2022-24566

In Checkmk =2.0.0p19 fixed in 2.0.0p20 and Checkmk =1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition is not properly escaped when shown as condition, which can result in Cross Site Scripting XSS...

Cross site scripting

In Checkmk =2.0.0p19 fixed in 2.0.0p20 and Checkmk =1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition is not properly escaped when shown as condition, which can result in Cross Site Scripting XSS...

PT-2022-16722 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions 1.6.0p27 and earlier Checkmk versions 2.0.0p19 and earlier Description: The issue arises from the title of a Predefined condition not being properly escaped when shown as a condition, which can result in Cross Site Scripting...

CVE-2022-24566: Improper Neutralization of Input During Web Page Generation

In Checkmk =2.0.0p19 fixed in 2.0.0p20 and Checkmk =1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition is not properly escaped when shown as condition, which can result in Cross Site Scripting XSS...

Check Point Response to CVE-2021-4034 - local privilege escalation in polkit's pkexec

Symptoms - A Local Privilege Escalation from any user to root was discovered in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution. The vulnerability allows unprivileged users to run commands as privileged users according to predefined policies. Fo...

The vulnerability of the automated information system “Registration in OO” arises from the use of pre-set user accounts, allowing a perpetrator to gain unauthorized access to protected information.

The vulnerability of the automated information system “Registration in OO” is related to the use of pre-set user accounts. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

User is still able to frontrun

Handle evertkors Vulnerability details Impact An attempt to solve front-running attacks by using the nextPrice model is not effective. Users are still able to execute a front-running attack as the time of the next price execution is arbitrary. The oracle is called at an arbitrary point in time...

CVE-2021-37593

PEEL Shopping version 9.4.0 allows remote SQL injection. A public user/guest unauthenticated can inject a malicious SQL query in order to affect the execution of predefined SQL commands. Upon a successful SQL injection attack, an attacker can read sensitive data from the database and possibly...

DRUPAL-CONTRIB-2021-024

This project enables administrators to restrict access from anonymous and regular users to pre-defined pages. The administration routes used by the project lacked proper permissions, allowing untrusted users to access, create and modify the module's settings...

Cook - A Customizable Wordlist And Password Generator

Easily create permutations and combinations of words with predefined sets of extensions, words and patterns/function. You can use this tool to easily create complex endpoints and passwords. Customizing tool according to your unique secrets keywords. Easy UX, Checkout Usage Installation Using Go g...

CVE-2020-4001

The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack...

CVE-2020-4001: Initialization of a Resource with an Insecure Default

The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack...

PT-2020-2066 · Yokogawa · Tristation

Name of the Vulnerable Software and Affected Versions: TriStation versions prior to 4.9.1 TriStation versions prior to 4.10.1 Description: A legacy support account in the TriStation software could cause improper access to the TriStation host machine. The issue is related to the presence of a...

Zyxel CNM SecuManager 3.1.0 / 3.1.1 Hardcoded Keys / XSS / Code Execution Vulnerabilities

Zyxel CNM SecuManager versions 3.1.0 and 3.1.1 suffer from having hard-coded secrets, missing authentication, backdoors, and remote code execution vulnerabilities. Zyxel CNM SecuManager 3.1.0 / 3.1.1 Hardcoded Keys / XSS / Code Execution The HTML version on "Multiple vulnerabilities found in Zyxe...

Zyxel CNM SecuManager 3.1.0 / 3.1.1 Hardcoded Keys / XSS / Code Execution

Hello, Please find a text-only version below sent to security mailing lists. The HTML version on "Multiple vulnerabilities found in Zyxel CNM SecuManager" is posted here: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html === text-version of the advisory ===...

IBM Informix Dynamic Server Buffer Overflow Vulnerability (CNVD-2019-29422)

IBM Informix Dynamic Server IDS is a scalable object-relational database server from IBM in the United States that provides continuous data availability and disaster recovery, among other features, for clustered data centers. A buffer overflow vulnerability exists in IBM Informix Dynamic Server,...

Microsoft Windows - Double Dereference in NtEnumerateKey Elevation of Privilege Exploit

Exploit for windows platform in category dos / poc Windows: Double Dereference in NtEnumerateKey Elevation of Privilege Platform: Windows 10 1803 not vulnerable in earlier versions Class: Elevation of Privilege Summary: A number of registry system calls do not correctly handle pre-defined keys...

Telegram Vulners Bot - Exploit Search Engine And Security Feed In Your Pocket

Vulners Bot is a Telegram interface for popular vulnerability database. It gives you availability of searching for exploits, tools, patches and many more using Telegram inline queries. But the most powerful feature is customizable security subscriptions feeds. You can select predefined themes or...