151 matches found
CVE-2022-21864
Windows UI Immersive Server API Elevation of Privilege Vulnerability...
CVE-2022-21864
Windows UI Immersive Server API Elevation of Privilege Vulnerability...
CVE-2022-21864
Windows UI Immersive Server API Elevation of Privilege Vulnerability...
The vulnerability relates to the SAPI extension of the PHP-FPM process runner, which is a PHP programming language interpreter. This vulnerability allows attackers to elevate their privileges to root.
The vulnerability of the SAPI extension for the PHP-FPM process interpreter involves access control issues when the processes are executed simultaneously. Exploiting this vulnerability can allow an attacker to gain elevated privileges to root...
HealthForYou 1.11.1 / HealthCoach 2.9.2 User Enumeration Vulnerability
User enumeration through API Overview Advisory ID: TRSA-2104-01 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2104-01 Affected product: HealthForYou & Sanitas HealthCoach mobile and web applications Tested versions: HealthForYou 1.11.1...
Arbitrary Code Execution
php is vulnerable to arbitrary code execution. A flaw was found in PHP's CGI server API. If the web server did not set DOCUMENTROOT environment variable for PHP e.g. when running PHP in the FastCGI server mode, an attacker could cause a crash of the PHP child process, causing a temporary denial o...
The vulnerability of the API interface of the Threat Intelligence Exchange Server allows attackers to compromise the integrity of the protected information.
The vulnerability of the Threat Intelligence Exchange Server’s API interface is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor, operating remotely, to compromise the integrity of the protected information through specially crafted...
CVE-2019-12103 – Analysis of a Pre-Auth RCE on the TP-Link M7350, with Ghidra!
TL;DR The TP-Link M7350 V3 is affected by a pre-authentication CVE-2019-12103, and a few post-authentication CVE-2019-12104 command injection vulnerabilities. These injections can be exploited remotely, if the attacker is on the same LAN or otherwise able to get access to the router web interface...
ipswitch WS_FTP Server Directory Traversal Vulnerability (CNVD-2019-24247)
ipswitch WSFTP Server is an FTP service program for Windows systems. A directory traversal vulnerability exists in SSHServerAPI.dll in ipswitch WSFTP Server versions prior to 2018 8.6.1. The vulnerability can be exploited by an attacker to obtain pathnames on the host operating system via the SCP...
ipswitch WS_FTP Server Directory Traversal Vulnerability (CNVD-2019-24249)
ipswitch WSFTP Server is an FTP service program for Windows systems. A directory traversal vulnerability exists in SSHServerAPI.dll in ipswitch WSFTP Server versions prior to 2018 8.6.1. The vulnerability can be exploited by an attacker to obtain WSFTP usernames and filenames via the SCP protocol...
ipswitch WS_FTP Server Directory Traversal Vulnerability
ipswitch WSFTP Server is an FTP service program for Windows systems. A directory traversal vulnerability exists in SSHServerAPI.dll in ipswitch WSFTP Server versions prior to 2018 8.6.1. An attacker can use this vulnerability to write files and create directories outside of their authorized...
CVE-2019-12144
An issue was discovered in SSHServerAPI.dll in Progress ipswitch WSFTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerability using the SCP protocol. Attackers who leverage this flaw could also obtain remote code execution by crafting a payload that abuses th...
Jupyter Notebook XSS via untrusted notebooks
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py,...
UBUNTU-CVE-2018-19351
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py,...
Cross site scripting
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py,...
Hardcoded credentials
The server API in the Anda app relies on hardcoded credentials...
CVE-2018-13342
The server API in the Anda app relies on hardcoded credentials...
CVE-2018-13342
The server API in the Anda app relies on hardcoded credentials...
CVE-2018-13342
CVE-2018-13342: The Anda app’s server API is vulnerable due to hardcoded credentials in its authentication flow. According to NVD, the CVSS scores are 7.5 (2.0) and 9.8 (3.0), indicating a high/critical impact with network access, no authentication, and full compromise of confidentiality, integri...
