530 matches found
CVE-2022-25094
Home Owners Collection Management System v1.0 was discovered to contain a remote code execution RCE vulnerability via the parameter "cover" in SystemSettings.php...
EC-CUBE improperly handles HTTP Host header values
Overview EC-CUBE provided by EC-CUBE CO.,LTD. improperly handles HTTP Host header values CWE-913. EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning...
JVN#53871926: EC-CUBE improperly handles HTTP Host header values
EC-CUBE provided by EC-CUBE CO.,LTD. improperly handles HTTP Host header values CWE-913. Impact A remote attacker may direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users. Solution Apply Workaround Apply the following workaround to avoid...
Cab Management System 1.0 - Remote Code Execution (RCE) (Authenticated)
Exploit Title: Cab Management System 1.0 - Remote Code Execution RCE Authenticated Exploit Author: Alperen Ergel Contact: @alpernae IG/TW Software Homepage: https://www.sourcecodester.com/php/15180/cab-management-system-phpoop-free-source-code.html Version : 1.0 Tested on: windows 10 xammp | Kali...
Home Owners Collection Management System 1.0 - Remote Code Execution (RCE) (Authenticated)
Exploit Title: Home Owners Collection Management System 1.0 - Remote Code Execution RCE Authenticated Date: 9/02/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
Hardcoded credentials
A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate users and system settings...
Simple Chatbot Application 代码问题漏洞
Simple Chatbot Application is a chatbot application by Carlo Montero Personal Developer. A security vulnerability exists in Simple Chatbot Application 1.0 due to remote code execution in the botavatar parameter in SystemSettings.php...
Online Project Time Management System 1.0 - Multiple Stored Cross Site Scripting (XSS) (Authenticated)
Exploit Title: Online Project Time Management System 1.0 - Multiple Stored XSS Authenticated Date: 19/01/2022 Exploit Author: Felipe Alcantara Filiplain Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
CVE-2021-38789
Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-party app could change system settings...
CVE-2021-38789
Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-party app could change system settings...
CVE-2021-38789
Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-party app could change system settings...
Improper access control
Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-party app could change system settings...
CVE-2021-38789
Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-party app could change system settings...
CVE-2021-38789
CVE-2021-38789 affects Allwinner R818 SoC with Android Q SDK V1.0. The issue is an incorrect access control vulnerability where the caller’s permission is not checked, enabling a non-specified third-party app to change system settings. Connected documents confirm the affected product and root cau...
Allwinner Technology R818 安全漏洞
The Allwinner Technology R818 is a quad-core intelligent voice with screen chip from Allwinner Technology Zhuhai, China. A security vulnerability exists in the Allwinner Technology R818, which stems from an access control security issue in the Android Q SDK V1.0 that can be exploited by an attack...
in pimcore/pimcore
Description The pimcore/pimcore package is an open source platform that provides PIM, MDM, CDP, DAM, DXP/CMS and digital commerce services. You can upload an infinite number of dangerous SVG files in "Settings" = "System Settings" = "Appearance and Branding" of the pimcore service. Then why is it...
CVE-2021-39971
Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could compromise confidentiality...
CVE-2021-39971
Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could compromise confidentiality...