The vulnerability of the ServiceAgent component of the wireless access point software for Moxa AWK-3131A industrial systems allows a intruder to disclose protected information.

The vulnerability of the ServiceAgent component of the wireless access point software for Moxa AWK-3131A industrial systems is related to the use of pre-installed registration data. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

DRUPAL-CONTRIB-2020-006

This module enables you to authenticate Drupal users using an external SAML Identity Provider. If the site is configured to allow visitors to register for user accounts but administrator approval is required, the module doesn't sufficiently enforce the administrative approval requirement, in the...

SAML Service Provider - Critical - Access bypass - SA-CONTRIB-2020-006

This module enables you to authenticate Drupal users using an external SAML Identity Provider. If the site is configured to allow visitors to register for user accounts but administrator approval is required, the module doesn't sufficiently enforce the administrative approval requirement, in the...

Joomla! 3.9.0 < 3.9.7 - CSV Injection

!/usr/bin/python3 Exploit Title: Joomla 3.9.0 ' printf'Example: sys.argv0 http://127.0.0.1 ' sys.exit1 baseurl = sys.argv1 regurl = f"baseurl/joomla/index.php/component/users/?view=registration&Itemid=101" loginurl = f"baseurl/joomla/index.php?option=comusers" def pwnusername='abdullah': payload ...

Update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 (Application Build 15.4.41345, Platform Build 15.0.41271)

None None...

OPENSUSE-SU-2020:0320-1 Security update for yast2-rmt

This update for yast2-rmt to version 1.3.0 fixes the following issues: Security issue fixed: - CVE-2018-20105: Fixed an exposure of the CA private key passphrase in the log file bsc1119835. Non-security issue fixed: - Add support for forwarding registration data from RMT to SCC This update was...

Helium: Cleartext Transmission of Sensitive Information Leads to administrator access

The weakness of the program is Cleartext Transmission of Sensitive Information through URL Leads to administrator access. This program is having one feature like we can add users like administrator and read-only, these are roles, into organizations. Here I get the administrator role at same...

CVE-2020-9458

In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users with minimal privileges to export submitted form data and settings via classrmformcontroller.php rmformexport...

SUSE-SU-2020:0578-1 Security update for yast2-rmt

This update for yast2-rmt to version 1.3.0 fixes the following issues: Security issue fixed: - CVE-2018-20105: Fixed an exposure of the CA private key passphrase in the log file bsc1119835. Non-security issue fixed: - Add support for forwarding registration data from RMT to SCC...

Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery (Add User)

Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery Add User Exploit Title: Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery Add User Date: 2020-01-30 Vendor Homepage: https://www.themeum.com/product/tutor-lms/ Vendor Changelog: https://wordpress.org/plugins/tutor/developer...

WordPress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery (Add User)

Exploit Title: Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery Add User Date: 2020-01-30 Vendor Homepage: https://www.themeum.com/product/tutor-lms/ Vendor Changelog: https://wordpress.org/plugins/tutor/developers Exploit Author: Jinson Varghese Behanan Author Advisory:...

Booked < 2.2.6 - Broken Authentication to Export Users Data in CSV

The plugin allows users to Book Appointment by providing their PII such as Email, Name, Phone Number and Personal Message. The vulnerability allows anyone to Dump all records of users and their appointment details in CSV as an unauthenticated user. The user also gets registered as a WP User after...

SpotFTP-FTP Password Recover 2.4.8 - Denial of Service Exploit

Exploit Title: SpotFTP-FTP Password Recover 2.4.8 - Denial of Service PoC Exploit Author: Ismael Nava Vendor Homepage: http://www.nsauditor.com/ Software Link: http://www.nsauditor.com/spotftp.html Version: 2.4.8 Tested on: Windows 10 Home x64 CVE : n/a STEPS Open the program SpotFTP-FTP Password...

The vulnerability of the Python programming language interpreter, related to errors in managing registration data, allows attackers to gain access to confidential information.

The vulnerability of the Python programming language interpreter is related to errors in managing registration data. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

The vulnerability of the NTLMv1 authentication component in Samba network communication tools allows a hacker to gain unauthorized access to confidential data.

The vulnerability of the NTLMv1 authentication component in Samba network interactions is related to incomplete protection of user registration data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential information...

Auto DNS registration by PVS Targets blocked by "Secure Updates Only" DNS setting

Auto DNS registration by PVS Targets blocked by "Secure Updates Only " DNS setting, plustheir timestamp in DNS showed "static "...

PT-2020-1379 · Cisco · Cisco Ios Xe Sd-Wan

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE SD-WAN Software versions 16.11 and earlier Description: A vulnerability in the software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device due to the existence of default credentials...

The vulnerability of the SAP Solution Manager platform, related to deficiencies in registration data management, allows a perpetrator to disclose protected information.

The vulnerability of the SAP Solution Manager software platform is related to deficiencies in the management of registration data. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

U.S. Dept Of Defense: [Critical] Insufficient Access Control On Registration Page of Webapps Website Allows Privilege Escalation to Administrator

Summary: Hello. Due to insufficient access controls and poor implementation of the registration at https://████████/████/login.cfm it was possible to register while privilege escalating to an administrator. Description: It was possible to tamper with the registration request at...

Insecure Session Management

Symfony uses an insecure session management. An attacker is able to authenticate as a privileged user on sites with user registration and the remember me login functionality enabled...