CVE-2023-51948

A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application...

Directory traversal

A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application...

CVE-2023-51948

A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application...

CVE-2023-51948

CVE-2023-51948 affects actidata actiNAS SL 2U-8 RDX 3.2.03-SP1, with a site-wide directory listing issue in the /fm endpoint that allows remote attackers to enumerate files hosted by the web application. The vulnerability, documented across NVD/Red Hat/CVE records, has a base CVSS v3.1 score of 7...

Qnap VioStor < 5.0.0 Command Injection (CVE-2023-47565)

The version of Qnap VioStor installed on the remote host is prior to 5.0.0. It is, therefore, affected by an OS command injection vulnerability. If exploited, the vulnerability could allow authenticated users to execute commands. Note that Nessus has not tested for these issues but has instead...

CVE-2024-22628

Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expensebudget/admin/?page=reports/budget&datestart=2023-12-28&dateend=...

CVE-2024-22626

Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /SupplyManagementSystem/admin/editretailer.php?id=...

Security Bulletin: [All] Apache Tomcat (core only) - CVE-2023-45648 (Publicly disclosed vulnerability)

Summary Apache Tomcat is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-45648 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of HTTP trailer headers. By sending a specially...

CVEs

CVE-2023-51947 Description Improper access control on nas...

PHPJabbers Car Park Booking System 3.0 Missing Rate Limiting

Exploit Title: PHPJabbers Car Park Booking System v3.0 - Missing Rate Limiting Date: 19/12/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/car-park-booking/sectionDemo Version: v3.0 Tested on:...

tomcat: Open Redirect vulnerability in FORM authentication

A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL...

CVE-2023-48250

The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts...

Hardcoded credentials

The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts...

CVE-2023-48250

CVE-2023-48250 affects Bosch Nexo devices; vulnerable component is the web authentication layer with hard-coded hidden accounts, enabling remote authentication with high privileges. Documents mention NEXO-OS and Bosch Nexo cordless nutrunner as affected, with the root cause cited as multiple hard...

CVE-2023-48250

The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts...

CVE-2023-48250

The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts...

Alert: New Vulnerabilities Discovered in QNAP and Kyocera Device Manager

A security flaw has been disclosed in Kyocera's Device Manager product that could be exploited by bad actors to carry out malicious activities on affected systems. "This vulnerability allows attackers to coerce authentication attempts to their own resources, such as a malicious SMB share, to...

CVE-2023-6149 Possible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security

Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize t...

CVE-2023-6149 Possible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security

Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize t...

Inis security breach

Inis is a web application. A security vulnerability exists in Inis version 2.0.1, which stems from the parameter path in the file /app/api/controller/default/File.php that causes path traversal...