11989 matches found
PrinterLogic Client Multiple Vulnerabilities (May 3, 2019)
The version of PrinterLogic Client installed on the remote host is affected by the following vulnerabilities: - The PrinterLogic Print Management software does not validate, or incorrectly validates, the PrinterLogic management portal's SSL certificate. When a certificate is invalid or malicious,...
Social Tape <= 1.0 - CSRF to Stored XSS
The plugin does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack alert/XSS/' /...
Shopify: Staff who only have apps and channels permission can do a takeover account at the wholesale store (Bypass get invitation link)
When we invite customers at the wholesale store there is a feature to "Send invite" and "Get invite link" the get invite link feature displays the customner invitation link and can only be used once, but when the customer has accepted the invitation and actived their account already have access t...
File Upload Vulnerability in OKLite
OKLite is an enterprise website system, the main target group is the display enterprise website users, so that the traditional small business quickly deploy the website. A file upload vulnerability exists in OKLite, which can be exploited by attackers to upload a webshell and gain server privileg...
Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040
Dave McDaniel discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered multiple vulnerabilities in the D-LINK DIR-3040 wireless router. The DIR-3040 is an AC3000-based wireless internet router. These vulnerabilities could allow an attacker to carry out a... This is...
Webmin 1.973 - Cross-Site Request Forgery (CSRF) Exploit
Exploit Title: Webmin 1.973 - Cross-Site Request Forgery CSRF Exploit Author: Mesh3l911 & Z0ldyck Vendor Homepage: https://www.webmin.com Repo Link: https://github.com/Mesh3l911/CVE-2021-31762 Version: Webmin 1.973 Tested on: All versions POC By \0331;m \0331;37mMesh3l\0331;m \0331;36m...
Garbage Collection Management System 1.0 Shell Upload / SQL Injection
Exploit Title: Garbage Collection Management System 1.0 - SQL Injection + Arbitrary File Upload Date: 05-07-2021 Exploit Author: Luca Bernardi - bernardiluca.job at protonmail.com | luca.bernardi at dedagroup.it Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
Reddit: Open Redirect on www.redditinc.com via `failed` query param
hello dear support I have found the issue on https://www.redditinc.com/ama HTTP request POST /ama HTTP/1.1 Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw Cookie:...
Protected: 5 Reasons Every Small Business Needs An Employee App
By Owais Sultan There is no excerpt because this is a protected post. This is a post from HackRead.com Read the original post: Protected: 5 Reasons Every Small Business Needs An Employee App...
Exploit for CVE-2021-34527
CVE-2021-34527mitigation Mitigation for CVE-2021-34527 RCE b...
OpenEMR 5.0.1.7 - (fileName) Path Traversal (Authenticated) Exploit (2)
Title: OpenEMR 5.0.1.7 - 'fileName' Path Traversal Authenticated 2 Exploit author: noraj Alexandre ZANNI for SEC-IT http://secit.fr Exploit source: https://github.com/sec-it/exploit-CVE-2019-14530 Vendor Homepage: https://www.open-emr.org/ Software Link:...
UVI-2021-1000926 net: ethernet: fix potential use-after-free in ec_bhf_remove
net: ethernet: fix potential use-after-free in ecbhfremove This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.128 by commit...
GSD-2021-1000852 bonding: init notify_work earlier to avoid uninitialized use
bonding: init notifywork earlier to avoid uninitialized use This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.237 by commit...
Unauthorized Access Vulnerability in Multiple Printers at Ricoh (China) Investment Co.
Ricoh China Investment Co., Ltd. provides services and solutions such as document output management services and IT solutions such as office image processing equipment e.g., MFPs, printers, etc., production digital printers, and more. An unauthorized access vulnerability exists in multiple printe...
GSD-2021-1000763 efi/libstub: prevent read overflow in find_file_option()
efi/libstub: prevent read overflow in findfileoption This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.43 by commit...
Unauthorized Access Vulnerability in Epson (China) Limited L6190 Series
Epson China Co., Ltd. was established in 1998, headquartered in Beijing, is responsible for overseeing Epson's investment and business development in China. An unauthorized access vulnerability exists in the Epson China Limited L6190 Series, which can be exploited by attackers to obtain sensitive...
Repository credentials passed to alternate domain
While working on the Helm source, a Helm core maintainer discovered a situation where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. Impact The index.yaml within a Helm chart repository contains a...
Missing Authentication for Critical Function
The vulnerability allows an attacker to substitute or modify packages retrieved from BC thus allowing to inject malicious code into ballerina executables...