294 matches found
Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration Exploit
Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration Exploit Author: Ricardo Ruiz @ricardojoserf CVE: CVE-2021-31159 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159 Vendor Homepage: https://www.manageengine.com Vendor Confirmation:...
Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration
Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration Date: 17/06/2021 Exploit Author: Ricardo Ruiz @ricardojoserf CVE: CVE-2021-31159 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159 Vendor Homepage: https://www.manageengine.com Vendor Confirmation:...
Ljcmsshop Cross-Site Scripting Vulnerability
Ljcmsshop is a Php-based online shopping mall system developed by China's Ljcms company. Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 suffers from a cross-site scripting vulnerability that allows a remote attacker to register an account directly in the user center, then a...
CVE-2020-25004
Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code...
CVE-2019-16066
An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 and prior. This allows an attacker to upload malicious files and perform arbitrary code execution on the system...
SQL Injection Vulnerability in ejucms us***.php File
EJU real estate system ejucms is a set of localized O2O real estate website platform system. A SQL injection vulnerability exists in the ejucms us.php file. An attacker can exploit this vulnerability to obtain sensitive information...
GitLab Insecure Direct Object Reference Vulnerability
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. An insecure direct object reference vulnerability exists in GitLab versions prior to 12.1.2, 12.0.4...
CVE-2011-1136
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file...
CVE-2011-1136
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file...
Design/Logic Flaw
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file...
CVE-2011-1136
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file...
TerraMaster FS-210 Elevation of Privilege Vulnerability
TerraMaster FS-210 is a NAS Network Attached Storage device from TerraMaster, a Shenzhen, China based company. An elevation of privilege vulnerability exists in TerraMaster FS-210 version 4.0.19, which can be exploited to elevate privileges with the help of the 1.user.php file...
CVE-2019-18384
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=public%25252FadminOnlyRead.txt substring...
Google Chrome Information Disclosure Vulnerability (CNVD-2019-03548)
Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in Google Chrome prior to version 66.0.3359.117, which originates in the File API, where the 'readAsText' function reads a user-selected file multiple times. The vulnerability can be...
CVE-2018-6109
readAsText can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page...
Design/Logic Flaw
readAsText can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page...
CVE-2018-6109
readAsText can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page...
CVE-2018-6109
readAsText can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page...
Linux kernel memory leak vulnerability (CNVD-2018-25184)
Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in Linux kernel versions prior to 4.19.3, which stems from the 'cryptoreportone' and related functions in the crypto/cryptouser.c file...