15862 matches found
Cacti host.php XSS
The vulnerability in the host.php script of the Cacti network monitoring software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
GHSA-9358-CPVX-C2QP Magento LTS's guest order "protect code" can be brute-forced too easily
Impact Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protectcode". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. Patch...
skydivingfatalities.info Cross Site Scripting vulnerability OBB-3669608
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Shuttle Booking Software 1.0 SQL Injection
Title: Shuttle-Booking-Software-1.0 Multiple-SQLi Author: nu11secur1ty Date: 09/10/2023 Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/shuttle-booking-software/sectionPricing Reference: https://portswigger.net/web-security/sql-injection Description: The locationid...
sticker-ribbon.com Cross Site Scripting vulnerability OBB-3657718
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Default configuration
IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration. IBM X-Force ID: 222592...
CVE-2022-22409 IBM Aspera Faspex information disclosure
IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration. IBM X-Force ID: 222592...
CVE-2022-22409
CVE-2022-22409 affects IBM Aspera Faspex 5.0.5 and earlier, where an insecure configuration can let a remote attacker gather sensitive information from the web application. The available connected documents confirm the root cause as a misconfiguration, leading to information disclosure with a bas...
Socomec MODULYS GP Security Vulnerability
The Socomec MODULYS GP is a green power device from Socomec France. A security vulnerability exists in the Socomec MODULYS GP that stems from incorrect session management in a web application, which could allow an attacker to steal a session cookie in order to perform a variety of actions allowed...
Dairy Farm Shop Management System SQL Injection Vulnerability
Dairy Farm Shop Management System is a Dairy Farm Shop Management System by Anuj Kumar, an individual developer. A security vulnerability exists in Dairy Farm Shop Management System Using PHP and MySQL v1.1, which stems from multiple SQL injection vulnerabilities in the Username and Password...
IBM Aspera Security Vulnerability
IBM Aspera is a suite of fast file transfer and streaming solutions from International Business Machines IBM built on the IBM FASP protocol. A security vulnerability exists in IBM Aspera Faspex version 5.0.5, which stems from an insecure configuration that allows a remote attacker to collect...
Socomec MODULYS GP Security Vulnerability
The Socomec MODULYS GP is a green power device from Socomec France. A security vulnerability exists in the Socomec MODULYS GP that stems from incorrect session management in a web application that allows remote access to credentials...
Information disclosure through insecure design
Introduction Insecure design can lead to many issues. The Software Development Life Cycle SDLC should contain steps to evaluate and consider security throughout the process. Several recent web application and API tests have revealed a common issue of responses containing too much data, and leakin...
PT-2023-5299 · Unknown · Modulys Gp
Name of the Vulnerable Software and Affected Versions: MODULYS GP MOD3GP-SY-120K affected versions not specified Description: The issue is related to incorrect session management within the web application, allowing attackers to steal session cookies and perform various actions on the device. Thi...
PT-2023-5297 · Unknown · Modulys Gp
Name of the Vulnerable Software and Affected Versions: MODULYS GP MOD3GP-SY-120K affected versions not specified Description: The issue is related to weaknesses in the user management level of a web application, allowing an attacker to obtain necessary information from headers to create specially...
PT-2023-5300 · Unknown · Modulys Gp
Name of the Vulnerable Software and Affected Versions: MODULYS GP MOD3GP-SY-120K affected versions not specified Description: The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be...
PT-2023-5301 · Unknown · Modulys Gp
Name of the Vulnerable Software and Affected Versions: MODULYS GP MOD3GP-SY-120K affected versions not specified Description: The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the...
Meeting Room Booking System-1.0 Multiple - SQL injection Vulnerability
Title: Meeting Room Booking System-1.0 Multiple - SQLi Author: nu11secur1ty Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/meeting-room-booking-system/sectionDemo Reference: https://portswigger.net/web-security/sql-injection Description: The column parameter appears to b...
SolarView Compact 6.00 Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SolarView Compact unauthenticated remote command execution vulnerability.', 'Description' = %q CONTEC's SolarView™ Series enables you to monitor...
WordPress Forminator Plugin < 1.24.4 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:incsub:forminator"; if description...