CVE-2021-31349

The usage of an internal HTTP header created an authentication bypass vulnerability CWE-287, allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to...

PT-2021-23561 · Unknown · Online Dj Booking Management System

Name of the Vulnerable Software and Affected Versions: Online DJ Booking Management System version 1.0 Description: The issue is related to Cross Site Scripting XSS in the view-booking-detail.php file. Recommendations: For Online DJ Booking Management System version 1.0, consider restricting acce...

Online Dj Booking Management System 跨站脚本漏洞

Online Dj Booking Management System is an online Dj booking management system by the individual developer Anuj Kumar. Online DJ Booking Management System suffers from a cross-site scripting vulnerability that originates from Online DJ Booking Management System 1.0 in view-booking-detail.php. An...

grafana: Snapshot authentication bypass

An authentication bypass was found in grafana. An attacker on the network is able to view and delete snapshots by accessing a literal path...

CVE-2021-42137

An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc...

Tad Web Authorization Issues Vulnerability

Tad Web is a multiplayer web module by the individual developer of Tad in Taiwan, China. An authorization issue vulnerability exists in Tad Web, which can be exploited by attackers to view announcements and upload files without logging in...

CVE-2021-41974

Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission...

CVE-2021-41567

The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks...

CVE-2021-41568

Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system...

CVE-2021-41567

The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks...

CVE-2021-41974

Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission...

PT-2021-23341 · Tad Web · Tad Web

Name of the Vulnerable Software and Affected Versions: Tad Web affected versions not specified Description: The issue allows remote attackers to bypass authorization, enabling them to exploit the system's original function for viewing bulletin boards and uploading files. Recommendations: At the...

Tad Web 访问控制错误漏洞

Tad Web is a multiplayer web module by the individual developer of Tad in Taiwan, China. An authorization issue vulnerability exists in Tad Web, which can be exploited by attackers to view announcements and upload files without logging in...

Online DJ Booking Management System 1.0 - (Multiple) Blind Cross-Site Scripting Vulnerability

Exploit Title: Online DJ Booking Management System 1.0 - 'Multiple' Blind Cross-Site Scripting Exploit Author: Yash Mahajan Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/online-dj-booking-management-system-using-php-and-mysql/ Version: V 1.0 Vulnerable endpoint:...

UBUNTU-CVE-2021-39226

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "publicmode" configurati...

Rails Unsafe Reflection

Ruby On Rails is a popular framework used to build web applications based on the Model-View-Controller MVC architectural pattern. Ruby On Rails provides a method called constantize which allows developers to dynamically find a constant by using a string. The most common usage of this method is to...

Booking Core 授权问题漏洞

Booking Core is a software application. A Laravel based booking system designed for travel websites, malls, travel agencies, tour operators, B&Bs, villa rentals, resort rentals, Make Travel websites. An Access Control Error vulnerability exists in Booking Core 2.0, which can be exploited by an...

CVE-2021-41847

An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user data such as personal information and Prox card credential...

Log Injection

ZoneMinder is vulnerable to log Injectio. An attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by the message=User%20'admin'%20Logged%20in value...

Cross-site Scripting (XSS)

zoneminder:edge is vulnerable to cross-site scripting. An attacker is able to execute HTML or JavaScript code in the view 'filter' as it insecurely prints the 'filterName' aka Filter name value on the web page without applying any proper filtration...