Discourse < 3.0.4 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescriptio...

bildungsportal.aachen.de Cross Site Scripting vulnerability OBB-3425754

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

webapps.cihr-irsc.gc.ca Cross Site Scripting vulnerability OBB-3421019

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

jazz-club-trier.de Cross Site Scripting vulnerability OBB-3418638

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-35036

In Progress MOVEit Transfer before 2021.0.7 13.0.7, 2021.1.5 13.1.5, 2022.0.5 14.0.5, 2022.1.6 14.1.6, and 2023.0.2 15.0.2, SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit...

Sql injection

In Progress MOVEit Transfer before 2021.0.7 13.0.7, 2021.1.5 13.1.5, 2022.0.5 14.0.5, 2022.1.6 14.1.6, and 2023.0.2 15.0.2, SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit...

Service Provider Management System SQL注入漏洞

Service Provider Management System is a web-based application developed by Carlo Montero, an individual developer. It is designed to provide dynamic websites for service provider companies. A security vulnerability exists in Service Provider Management System v1.0, which was discovered to contain...

CVE-2023-35036

MOVEit Transfer is affected by a SQL injection vulnerability in its web application. Connected sources confirm an unauthenticated attacker could modify and disclose MOVEit’s database content due to how SQL queries are constructed. Affected versions include pre-2021.0.7 (13.0.7), 2021.1.5 (13.1.5)...

TerraMaster TOS 4.2.06 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution', 'Description' = %q This module exploits an unauthenticated remote...

CVE-2023-22582

The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting...

CVE-2023-22585

The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter...

CVE-2023-25911

The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters...

Remote file inclusion

The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter...

Cross site scripting

The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter...

Command injection

The Danfoss AK-EM100 web applications allow for OS command injection through the web application parameters...

CVE-2023-25911

CVE-2023-25911 describes an authenticated OS command injection in Danfoss AK-EM100 web applications, exploitable via web-application parameters. Multiple connected sources confirm the issue and the impact (high/critical) with network access and low attack complexity, requiring low privileges and ...

CVE-2023-25911 Authenticated OS Command Injection in Danfoss AK-EM100

The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters...

CVE-2023-22585

The CVE-2023-22585 entry concerns the Danfoss AK-EM100 web applications, where the vulnerable component is the web application itself and the root cause is a Reflected Cross-Site Scripting vulnerability in the title parameter. This allows injection of malicious scripts when user-supplied input is...

CVE-2023-22586

CVE-2023-22586 concerns the Danfoss AK-EM100 web applications, where a vulnerability in the web app’s file parameter allows Local File Inclusion. The description is consistently reported across NVD/Red Hat/CVE lists as a Local File Inclusion issue affecting Danfoss AK-EM100. The connected sources...

PT-2023-18571 · Danfoss · Danfoss Ak-Em100

Name of the Vulnerable Software and Affected Versions: Danfoss AK-EM100 affected versions not specified Description: The issue concerns Local File Inclusion in the file parameter of the web application. This allows for potential access to sensitive files on the system. Recommendations: At the...