Vulnerability of the /admin/bookings/view_booking.php script of the SourceCodester AC Repair and Services system, allowing a hacker to execute arbitrary SQL code

The vulnerability in the “/admin/bookings/viewbooking.php” script of the SourceCodester AC Repair and Services system relates to the lack of protective measures for the SQL query structure when processing the parameter “tomail=&groupid=”. Exploiting this vulnerability allows an attacker to execut...

PT-2023-12764 · Audiocodes · Audiocodes Device Manager Express

Name of the Vulnerable Software and Affected Versions: AudioCodes Device Manager Express versions through 7.8.20002.47752 Description: The issue concerns directory traversal during file download. This occurs via the view parameter in the "BrowseFiles.php" endpoint. Recommendations: For versions...

The vulnerability of the TokenUtils component in the D-View 8 network device management platform allows a hacker to bypass the authentication process.

The vulnerability of the TokenUtils component in the D-View 8 network device management platform is related to the use of a rigidly encrypted cryptographic key. Exploiting this vulnerability could allow an attacker to bypass the authentication process remotely...

Encourage Technologies ESS REC Agent Server 路径遍历漏洞

Encourage Technologies ESS REC Agent Server is a software system from Encourage Technologies for receiving, processing, and managing audio and video data from surveillance devices. A security vulnerability exists in Encourage Technologies ESS REC Agent Server that stems from the presence of a...

The vulnerability of the uploadFile function in the D-View 8 network device management platform allows a hacker to create arbitrary files.

The vulnerability of the uploadFile function in the D-View 8 network device management platform is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to create arbitrary files remotely...

The vulnerability of the showUser method in the D-View 8 network device management platform allows a hacker to escalate their privileges.

The vulnerability of the showUser method in the D-View 8 network device management platform is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

Spring Framework 资源管理错误漏洞

Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. A security vulnerability exists in Spring Framework that stems from a possible Denial of Service DoS attack if Spring MVC is used wi...

The vulnerability of the uploadMib function in the D-View 8 network device management platform allows a hacker to delete any files they desire.

The vulnerability of the uploadMib function in the D-View 8 network device management platform is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to delete any files they desire...

The vulnerability of the TftpReceiveFileHandler component in the D-View 8 network device management platform allows a hacker to execute arbitrary code within the kernel context.

The vulnerability of the TftpReceiveFileHandler component in the D-View 8 network device management platform is related to an incorrect limitation on the path to the restricted access directory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code within the kerne...

The vulnerability of the TftpSendFileThread component in the D-View 8 network device management platform allows a hacker to disclose protected information.

The vulnerability of the TftpSendFileThread component in the D-View 8 network device management platform is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability could allow a remote attacker to disclose the protected information...

GHSA-J65R-G7Q2-F8V3 Pimcore customers' list user password hash is disclosed

Impact The customer view exposes the hashed password along with other deails. An attacker is then able to enum password of a particular id, likewise we can replace id with other user , for example 1015, password hash can be disclosed which can be further cracked with hashcat Patches Update to...

PT-2023-24588 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.4 through 7.4.3.48 Liferay DXP 7.4 before update 49 Description: The issue allows remote authenticated users in one virtual instance to view objects in a different virtual instance via the OAuth 2 scope...

D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TftpReceiveFileHandler class. The issue results from the lack of proper validation of ...

D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TftpSendFileThread class. The issue results from the lack of proper validation...

D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability

This vulnerability allows remote attackers to create and delete arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadMib function. The issue results from the lack of proper validation of a...

D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TokenUtils class. The issue results from a hard-coded cryptographic key. An attacker ca...

D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability

This vulnerability allows remote attackers to create arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadFile function. The issue results from the lack of proper validation of a user-suppli...

D-Link D-View showUser Improper Authorization Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the showUser method. The issue results from the lack of proper authorization before accessing a...

CVE-2023-30469

Cross-site Scripting vulnerability in Hitachi Ops Center Analyzer Hitachi Ops Center Analyzer detail view component allows Reflected XSS.This issue affects Hitachi Ops Center Analyzer: from 10.9.1-00 before 10.9.2-00...

Microsoft Edge (Chromium) < 113.0.1774.50 / 112.0.1722.84 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 113.0.1774.50 / 112.0.1722.84. It is, therefore, affected by multiple vulnerabilities as referenced in the May 18, 2023 advisory. - Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote...