3514 matches found
OpenEMR 跨站请求伪造漏洞
OpenEMR is an open source medical management system from the OpenEMR Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A cross-site request forgery vulnerability exists in OpenEMR version...
CVE-2018-16795: Cross-Site Request Forgery (CSRF)
OpenEMR 5.0.1.3 allows Cross-Site Request Forgery CSRF via library/ajax and interface/super, as demonstrated by use of interface/super/managesitefiles.php to upload a .php file...
Linux: Read /etc/inetd.* and /etc/xinetd.* files
xinetd performs the same function as inetd: it starts programs that provide Internet services. Instead of having such servers started at system initialization time, and be dormant until a connection request arrives, xinetd is the only daemon process started and it listens on all service ports for...
kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c
A flaw was found in the Linux kernel's ext4unlink function. An attacker could corrupt memory or escalate privileges when deleting a file from a recently unmounted specially crafted ext4 filesystem, including local, USB, and iSCSI...
Privilege Escalation
Super is vulnerable to privilege escalation. The vulnerability existed because it does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors...
Super Backup 2.0.5 Directory Traversal
Document Title: =============== Super Backup v2.0.5 iOS - Directory Traversal Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2200 Release Date: ============= 2020-04-30 Vulnerability Laboratory ID VL-ID: ==================================...
Elastic: Async search stores authorization headers in clear text
Summary: The .async-search index stores the results of async searches. It also stores a copy of the requests authorization headers, in clear text. These clear text authorization headers are then available to anyone with access to .async-search, probably mostly super users. Description: While you...
kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c
A flaw was found in the Linux kernel's ext4unlink function. An attacker could corrupt memory or escalate privileges when deleting a file from a recently unmounted specially crafted ext4 filesystem, including local, USB, and iSCSI...
IBM Cognos Controller Elevation of Privilege Vulnerability
IBM Cognos Controller is a suite of business intelligence and planning solutions from IBM in the United States. The product features process automation, financial audit control, and the creation and management of financial reports. IBM Cognos Controller suffers from a security vulnerability that...
Super Store Finder 3.3 Cross Site Scripting
Exploit type : XSS INJECTION Exploit title : Super Store Finder Add location XSS Injection Descriptions : XSS injection from adding store and reflected XSS in SQL error login page PHP Script affected : Super Store Finder | Mega Locator Plugin URI : http://www.superstorefinder.net/ Version : 3.3 a...
RED-V Super Digital Signage System RXV-A740R Log Information Disclosure
RED-V Super Digital Signage System RXV-A740R Log Information Disclosure Vendor: RED-V S.R.L. Product web page: https://www.red-v.tv https://red-v.tv/digital-signage.html Affected version: Model name: RXV-A740R Android version: 5.1.1 Firmware version: 026 Player version: 7.8.6 Downloader version:...
RED-V Super Digital Signage System RXV-A740R Log Information Disclosure
Summary RED-V Super Digital Signage transforms simple screens into customized TV channels, delivering audiovisual communication as immersive user experiences. It is the final blending of years of know-how in multimedia, mobile and web experience, tablet and multimedia server design. Description T...
CVE-2020-4685
A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos...
CVE-2020-4685: Undefined Security Weakness
A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos...
super-lesenka.ru Cross Site Scripting vulnerability OBB-1469824
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Hubei PointPoint Technology Co., Ltd. to help the management of CRM customer management system there are unauthorized access vulnerabilities
Help the manager CRM is Hubei point point technology limited company products, focusing on small and medium-sized enterprises to provide collaborative management software, office management solutions and cloud services, is committed to creating high-quality low-priced enterprise office management...
Logic Flaw Vulnerability in Ad***.php File in Zibo's New X1.0 System
Zibo's new X1.0 system is a website management system based on the latest thinkphp5 framework. A logic flaw vulnerability exists in the Ad.php file of the Qibo New X1.0 system. An attacker can exploit the vulnerability to forge a super administrator cookie and log in to the system as a super...
charlestonsuperads.com Cross Site Scripting vulnerability OBB-1446711
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
WordPress Super Store Finder premium plugin <= 6.1 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability found by Eagle Eye in WordPress Super Store Finder premium plugin versions = 6.1. Solution Update the WordPress Super Store Finder premium plugin to the latest available version at least 6.2...
Logic flaw vulnerability in Extreme CMS Sy***.php file
Extreme CMS is an open source and free PHPCMS web content management system. A logic flaw vulnerability exists in the Extreme CMS Sy.php file. An attacker can exploit the vulnerability to overstep the authority to modify the relevant functions of the super administrator...