GitLab 安全漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug list, and more. A security vulnerability exists in GitLab EE, which stems...

PT-2021-6695 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 Description: The issue is related to improper authorization in GitLab, allowing a remote attacker to impact data integrity. It is also described as an improper access control issue, enabling use...

CVE-2021-33325

The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the...

CVE-2021-33325

The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the...

WordPress File Management Plugin Riddled with Critical Bugs

A critical cross-site scripting XSS bug impacts WordPress sites running the Frontend File Manager plugin and allows remote unauthenticated users to inject JavaScript code into vulnerable websites to create admin user accounts. The bug is one of six critical flaws impacting the WordPress plugin...

Simple Client Management System 1.0 - Remote Code Execution Exploit

Exploit Title: Simple Client Management System 1.0 - Remote Code Execution RCE Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/client-details.zip Version: 1.0 Tested on: Windows 10 Hom...

Simple Client Management System 1.0 - Remote Code Execution (RCE)

Exploit Title: Simple Client Management System 1.0 - Remote Code Execution RCE Date: July 4, 2021 Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/client-details.zip Version: 1.0 Tested...

Monitorr 1.7.6m Bypass / Information Disclosure / Shell Upload Exploit

!/usr/bin/env ruby Exploit Title: Monitorr exploit toolkit Google Dorks: inurl:/assets/config/installation/register.php?action=register Author: noraj Alexandre ZANNI for SEC-IT http://secit.fr Author website: https://pwn.by/noraj/ Exploit source: https://github.com/sec-it/monitorr-exploit-toolkit...

Exploit for Incorrect Authorization in Polkit_Project Polkit

Polkit-exploit - CVE-2021-3560 Privilege escalation with polki...

CVE-2021-20998

In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users...

CVE-2021-20998

In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users...

Authorization

In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users...

CVE-2021-20998

CVE-2021-20998 affects WAGO 750-88x series managed switches/PLCs. The vulnerability enables unauthorized creation of user accounts via specially crafted packets, indicating an unauthenticated access path that can impact confidentiality, integrity, and availability. Public references describe the ...

Chamilo LMS Authorization Issues Vulnerability

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. An authorization issue vulnerability exists in Chamilo LMS version 1.11.10,...

Privilege escalation

Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege...

CVE-2020-23128

CVE-2020-23128 affects Chamilo LMS 1.11.10. The issue is improper privilege management: a user with Sessions administrator privileges can create a new user and then use the Edit User function to grant that user administrator privileges. The connected sources consistently describe this as a privil...

How to create read-only users on xenserver

Create read-only users on xenserver...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials...

CVE-2021-30224

Cross Site Request Forgery CSRF in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials...

VulnCheck KEV: CVE-2020-6287

SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users...