The vulnerability of the KTS web interface “Mayak,” related to the failure to protect the SQL query structure, allows attackers to execute arbitrary SQL commands.

The vulnerability of the KTS “Lighthouse” web interface is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands using a specially crafted HTTP POST request...

Slider by 10Web < 1.2.36 - Multiple Authenticated SQL Injection

The bulkaction, exportfull and savesliderdb functionalities of the plugin were vulnerable, allowing a high privileged user Admin, or medium one such as Contributor+ if "Role Options" is turn on for other users to perform a SQL Injection attacks. Vulnerable param: check Vulnerable function:...

The vulnerability of the Adobe Bridge file manager relates to the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of the Adobe Bridge file manager is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted request...

Control Web Panel 0.9.8.864 phpMyAdmin Password Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title : CWP Control Web Panel phpMyAdmin password access Exploit Author : Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage : https://control-webpanel.com/ Software Link : Not available, user panel only...

Unspecified Vulnerability in CloudBees Jenkins Dynatrace Application Monitoring Plugin

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Dynatrace Application Monitoring Plugin is us...

RDK WebUI Component Access Control Error Vulnerability

RDK Management RDK is a modular, portable, and customizable open source IoT software solution from the RDK Management community. An access control error vulnerability exists in the actionHandlerUtility.php file of the WebUI component in version RDK RDKB-20181217-1. An attacker can exploit the...

HPE CentralView Fraud Risk Management Elevation of Privilege Vulnerability

HPE CentralView Fraud Risk Management is an end-to-end solution for addressing fraud control issues. An elevation of privilege vulnerability exists in HPE CentralView Fraud Risk Management, which can be exploited by an attacker to submit a special request to elevate privileges...

CA Workload Control Center Arbitrary Code Execution Vulnerability

CA Workload Control Center is the GUI for CA Workload Automation AE. An arbitrary code execution vulnerability exists in CA Workload Control Center. A remote attacker could exploit this vulnerability to execute arbitrary code via a specially crafted HTTP request...

Bitpay/insight-api Insight-api transaction broadcast endpoint input validation vulnerability

Bitpay/insight-api Insight-api is a Bitpay payment software program that uses Bitcoin. transaction broadcast endpoint is one of the payment terminals. An input validation vulnerability exists in the transaction broadcast endpoint in Bitpay/insight-api Insight-api version 5.0.0 and earlier. An...

CVE-2018-0096

A vulnerability in the role-based access control RBAC functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to ...

Microsoft Windows 'Win32k.sys' Local Information Disclosure Vulnerability

Microsoft Windows is the popular operating system. Microsoft Windows Win32k does not properly handle memory objects, allowing an attacker to exploit a vulnerability by submitting a special request that could obtain sensitive information...

IBM Kenexa LCMS Premier on Cloud Information Disclosure Vulnerability (CNVD-2017-01326)

IBM Kenexa LCMS Premier on Cloud is an adjustable Learning Content Management System LCMS for developing, maintaining, and delivering effective employee training from IBM USA. A security vulnerability exists in IBM Kenexa LCMS Premier on Cloud. An attacker could exploit the vulnerability by sendi...

Arbitrary File Deletion Vulnerability in Zoomla!

Zoomla! Wave CMS is a CMS website core and management system R & D vendors, integrated content management, shopping malls, OA, SNS, project management, collection, e-mail subscription to hundreds of features , based on the . net platform and support cross-platform and mobile. Zoomla! CMS has an...

Arbitrary Password Changing Vulnerability in Hi-Read Media's Digital Newspaper System

Joy Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. The product /www/index.php?mod=admin&con=adminuser&act=editpost there is an arbitrary password change vulnerability, an attacker can exploit the vulnerability by submitting a POST request to change the...

Ubiquiti Inc.: UniFi Video Server - Arbitrary file upload as SYSTEM

In UniFi Video Server prior to 3.3.0, due to lack of filename verification, it was possible to upload files to arbitrary locations using a especially crafted HTTP request. The exploit require valid credentials and is only exploitable in the Windows version...

EUVD-2015-6376

An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System UCS Manager before 2.24b, 2.25 before 2.25a, and 3.0 before 3.02e allows remote attackers to execute arbitrary shell commands via a crafted HTTP request, aka Bug ID CSCur90888...

CVE-2014-8384

The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modify the DHCP server and device IP configuration, reboot the device, change the device name, and have other unspecified impact via a crafted request...

PT-2013-5212 · Hewlett Packard · Hp Procurve Manager +2

Name of the Vulnerable Software and Affected Versions: HP ProCurve Manager versions 3.20 through 4.0 HP PCM+ versions 3.20 through 4.0 Identity Driven Manager version 4.0 Description: The issue allows remote attackers to execute arbitrary commands via a HEAD request. This is related to the Agent...

CVE-2012-3867

lib/puppet/ssl/certificateauthority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request CSR, which makes it easier for user-assisted remote attackers to trick...

CVE-2009-3295

The prepreprocessreq function in kdc/dotgsreq.c in the cross-realm referral implementation in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.7 before 1.7.1 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a ticket request...