CVE-2021-40904

The web management console of CheckMK Raw Edition versions 1.5.0 to 1.6.0 allows a misconfiguration of the web-app Dokuwiki installed by default, which allows embedded php code. As a result, remote code execution is achieved. Successful exploitation requires access to the web management interface...

CVE-2021-40904

The web management console of CheckMK Raw Edition versions 1.5.0 to 1.6.0 allows a misconfiguration of the web-app Dokuwiki installed by default, which allows embedded php code. As a result, remote code execution is achieved. Successful exploitation requires access to the web management interface...

The vulnerability of the valid.c file in the XML document analysis library libxml2, related to memory usage after deallocation, allows an attacker to execute arbitrary code.

The vulnerability of the valid.c file in the XML document analysis library libxml2 relates to memory usage after deallocation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially created XML file...

Checkmk 代码问题漏洞

Checkmk is an editor. A code issue vulnerability exists in CheckMK Enterprise Edition that stems from a successful exploit requiring access to the web administration interface using valid credentials or by hijacking the session of a user with the administrator role...

CVE-2022-1030

Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute...

CVE-2022-1030

Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute...

PT-2022-13603 · Okta · Okta Advanced Server Access Client

Name of the Vulnerable Software and Affected Versions: Okta Advanced Server Access Client for Linux and macOS versions prior to 1.58.0 Description: The issue allows for command injection via a specially crafted URL. An attacker with knowledge of a valid team name for the victim and a valid target...

Oh365UserFinder - Python3 O365 User Enumeration Tool

Oh365UserFinder is used for identifying valid o365 accounts and domains without the risk of account lockouts. The tool parses responses to identify the "IfExistsResult" flag is null or not, and responds appropriately if the user is valid. The tool will attempt to identify false positives based on...

Tiny File Manager路径遍历漏洞

Tiny File Manager is a web-based open source file manager. A path traversal vulnerability in the tinyfilemanager.php file upload function in Tiny File Manager 2.4.1 allows remote attackers to upload malicious PHP files to the webroot using a valid user account and achieve code execution on the...

CVE-2021-45886

An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...

CVE-2021-45886

An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...

Axis IP Camera Shell Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Axis IP Camera Application Upload', 'Description' = %q This module exploits the "Apps" feature in Axis IP cameras. The feature allows third party...

Kerbrute - An Script To Perform Kerberos Bruteforcing By Using Impacket

An script to perform kerberos bruteforcing by using the Impacket library. When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force attack to enumerate: Valid username/passwords pairs Valid usernames Usernames without...

CVE-2022-24032

Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames on the platform because a failed login attempt produces a different error message when the username is valid...

PT-2022-16426 · Adenza · Adenza Axiomsl Controllerview

Name of the Vulnerable Software and Affected Versions: Adenza AxiomSL ControllerView versions through 10.8.1 Description: The issue allows an attacker to identify valid usernames on the platform due to a difference in error messages produced by failed login attempts when the username is valid...

Adenza AxiomSL 安全漏洞

Adenza AxiomSL is a risk and regulatory reporting platform from Adenza USA. A security vulnerability exists in Adenza AxiomSL ControllerView that allows an attacker to recognize a valid username on the platform, as failed login attempts generate a different error message when the username is vali...

CVE-2022-23033

arm: guestphysmapremovepage not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm p2mremovemapping, guestphysmapremovepage, and p2msetentry with mfn set to INVALIDMFN do not actually clear the pagetable entry if the entry doesn't have the vali...

@hola.org/har-validator (=2.0.6-hola.1), @hola.org/request (>=2.67.0-hola.5 <=2.67.0-hola.6) +46 more potentially affected by CVE-2018-1107 via is-my-json-valid (>=2.10.1 <=2.17.1)

is-my-json-valid NPM version =2.10.1, =2.67.0-hola.5, =2.67.0-lum.3, =1.0.1, =1.2.0, =1.0.0, =0.4.0, =1.0.0, =0.4.1, =0.0.1, =0.0.10 - fsa-creator =0.1.1 - geojsonvalidator =0.0.1 and more Source cves: CVE-2018-1107 Source advisory: OSV:GHSA-4HPF-3WQ7-5RPR...

GHSA-4HPF-3WQ7-5RPR Regular expression deinal of service (ReDoS) in is-my-json-valid

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated...

Duplicate Collateral could cause financial instability

Handle csanuragjain Vulnerability details Impact Duplicate collaterals can be added which makes getValidCollateral return duplicate items. This impacts all function which uses getValidCollateral function like getPendingCollRewards, which will now calculate the pending reward twice for the duplica...