1858 matches found
AlmaLinux 8 : mariadb:10.3 (ALSA-2019:3708)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2019:3708 advisory. mysql: InnoDB unspecified vulnerability CPU Jan 2019 CVE-2019-2510 mysql: Server: DDL unspecified vulnerability CPU Jan 2019 CVE-2019-2537 mysql: Server:...
Path Traversal in liukuo362573/yishaadmin
Description https://www.github.com/liukuo362573/yishaadmin has an endpoint "/admin/File/DownloadFile" that allows downloading/deleting files without authentication. In addition, this endpoint has path traversal vulnerability that allows arbitrary file read/delete. Proof of Concept - using BurpSui...
CVE-2021-22821
A CWE-918 Server-Side Request Forgery SSRF vulnerability exists that could cause the station web server to forward requests to unintended network targets when crafted malicious parameters are submitted to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 All...
Perfect Brands for WooCommerce < 2.0.5 - Subscriber+ Sensitive Information Disclosure
The plugin does not have authorisation and CSRF checks in some of its AJAX actions, which could allow any authenticated users, such as subscriber to retrieve sensitive information about the server...
Mageia: Security Advisory (MGASA-2019-0181)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SQL Injection
showdoc/showdoc is vulnerable to SQL Injection attacks. The library does not properly sanitize the uid parameter which is an user input, allowing a malicious user to inject and execute arbitrary SQL queries on the server...
Updated phpmyadmin packages fix security vulnerability
A flaw was identified in how phpMyAdmin processes two factor authentication; a user could potentially manipulate their account to bypass two factor authentication in subsequent authentication sessions PMASA-2022-1. A series of weaknesses was identified allowing a malicious user to submit maliciou...
16 Best DDOS Attack Tools in 2022
What are DDOS attack tools? DDOS attacks are cyber- attacks targeted at rendering certain computers, network systems and servers non-functional. The processes involved in its execution can be however complicated. Attackers have to carry out a long series of actions that involve social engineering...
CVE-2021-23195
CVE-2021-23195 affects Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) 2.0.1.3. The issue is exposure of information through directory listing: if directory listing is enabled and no index file exists, a web server may return entire directory contents in HTML, enabling an attacker to...
Remote Code Execution
h2 is vulnerable to remote code execution. The vulnerability exists due to a lack of secure input validation in DatabaseMetaLocal.java , allowing remote authenticated attackers to execute arbitrary code in the server...
Unrestricted File Upload
pimcore/pimcore allows unrestricted file uploads. The vulnerability exists due to a lack of sanitization of the file type during upload allowing local authenticated attackers to execute malicious scripts on the server...
CVE-2021-46104
An issue was discovered in webpservergo 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server...
CVE-2022-21358
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...
Code injection
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Federated. Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...
CVE-2022-21372
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...
CVE-2022-21352
CVE-2022-21352 affects Oracle MySQL Server (InnoDB) with impacted versions 8.0.26 and prior. The vulnerability is described as allowing a high-privilege attacker with network access via multiple protocols to compromise MySQL Server, potentially leading to unauthorized creation, deletion, or modif...
RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read
The plugin does not have proper authorisation, CSRF checks and validation of the rvmuploadregionsfilepath parameter in the rvmimportregions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server PoC As a subscriber, open...
CVE-2021-44790
CVE-2021-44790 affects Apache HTTP Server up to version 2.4.51. It describes a buffer overflow in the mod_lua multipart parser (triggered via r:parsebody() from Lua scripts). Connected documents corroborate this in various advisories and patch notes, indicating releases with fixes (e.g., patched ...
PHP file inclusion in the Sulu admin panel
Impact What kind of vulnerability is it? Who is impacted? An attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. Compromised components: Arbitrary file read on the server, Potential Remote code execution Exploitation...
[eBook] Guide to Achieving 24x7 Threat Monitoring and Response for Lean IT Security Teams
If there is one thing the past few years have taught the world, it’s that cybercrime never sleeps. For organizations of any size and scope, having around-the-clock protection for their endpoints, networks, and servers is no longer optional, but it’s also not entirely feasible for many. Attackers...