The vulnerability of the Connectize G6 AC2100 router’s microprogramming software lies in the lack of protective measures for the website structure, allowing attackers to alter the Wi-Fi password.

The vulnerability of the Connectize G6 AC2100 router’s microprogramming software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to change the Wi-Fi password remotely...

AZL-26809 CVE-2023-28320 affecting package mysql for versions less than 8.0.34-1

A denial of service vulnerability exists in curl v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm and siglongjmp. When doi...

CVE-2023-0504

The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...

ecto 安全漏洞

ecto is an elixir-ecto open source toolkit for data mapping and language integration queries. A security vulnerability exists in ecto version 2.2.0, which stems from the lack of some kind of protection mechanism...

EasyVista 安全漏洞

EasyVista is an application from EasyVista, Inc. creates digital experiences that help organizations work smarter, faster, and better automatically. A security vulnerability exists in EasyVista version 2020.2.125.3, which stems from the fact that some applications do not implement protection...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to execute arbitrary code or gain unauthorized access to protected information.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or gain unauthorized access to...

The vulnerability of the WPE WebKit web page rendering module, related to the lack of measures taken to protect the structure of the web page, allows attackers to access confidential data.

The vulnerability of the WPE WebKit web page rendering module is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

CVE-2022-36670

PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable...

CVE-2022-36670

PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable...

CVE-2022-1612

The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-0830

The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put...

The vulnerability of the embedded software of NETGEAR’s RAX200, MR60, RAX20, RAX45, RAX80, MS60, RAX15, RAX50, RAX75, RBR750, RBR850, RBS750, and RBK752 routers exists due to the lack of protective measures for the website structure. This vulnerability allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the embedded software of NETGEAR’s RAX200, MR60, RAX20, RAX45, RAX80, MS60, RAX15, RAX50, RAX75, RBR750, RBR850, RBS750, RBS850, RBK752, and RBK852 routers exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a...

The vulnerability of the GitBucket collaborative development web service lies in its lack of protection for website structures, allowing attackers to execute arbitrary code.

The vulnerability in the collaborative development web service GitBucket is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2021-24490

The Email Artillery MASS EMAIL WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well...

Comment Link Remove and Other Comment Tools < 2.1.6 - Arbitrary Comment Deletion via CSRF

The plugin does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments PoC POST /wp-admin/admin.php?page=comment-link-remove HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8...

CVE-2021-3453

Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage...

CVE-2021-24434

The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a...

Cross-Site Request Forgery (CSRF) in bigprof-software/online-invoicing-system

✍️ Description The app/admin/pageDeleteGroup.php?groupID= does not have a CSRF protection. This could be used by attackers to trick the admin to delete a group from their invoice system. 🕵️‍♂️ Proof of Concept For this attack to work, a logged in admin, should visit the POC page...

Cross-Site Request Forgery (CSRF) in erudika/scoold

✍️ Description The /voteup/question/ endpoint does not have a CSRF protection. This could be exploited by an attacker to manipulate votes in a question. 🕵️‍♂️ Proof of Concept An attacker creates the following web page and sends a link to a logged in user. // PoC.html Click Here When an...

The vulnerability of the programmable logic controller Modicon TSX TWIDO, related to the absence of a mechanism to protect operational data, allows a intruder to obtain the project password.

The vulnerability of the embedded software of the programmable logic controller Modicon TSX TWIDO is related to the absence of a mechanism for protecting operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to obtain the project password...