Sql injection

In Progress MOVEit Transfer before 2021.0.7 13.0.7, 2021.1.5 13.1.5, 2022.0.5 14.0.5, 2022.1.6 14.1.6, and 2023.0.2 15.0.2, SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit...

CVE-2023-35036

MOVEit Transfer is affected by a SQL injection vulnerability in its web application. Connected sources confirm an unauthenticated attacker could modify and disclose MOVEit’s database content due to how SQL queries are constructed. Affected versions include pre-2021.0.7 (13.0.7), 2021.1.5 (13.1.5)...

TerraMaster TOS 4.2.06 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution', 'Description' = %q This module exploits an unauthenticated remote...

Service Provider Management System SQL注入漏洞

Service Provider Management System is a web-based application developed by Carlo Montero, an individual developer. It is designed to provide dynamic websites for service provider companies. A security vulnerability exists in Service Provider Management System v1.0, which was discovered to contain...

CVE-2023-22582

The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting...

CVE-2023-22585

The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter...

CVE-2023-25911

The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters...

Remote file inclusion

The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter...

Cross site scripting

The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter...

Command injection

The Danfoss AK-EM100 web applications allow for OS command injection through the web application parameters...

CVE-2023-25911 Authenticated OS Command Injection in Danfoss AK-EM100

The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters...

CVE-2023-25911

CVE-2023-25911 describes an authenticated OS command injection in Danfoss AK-EM100 web applications, exploitable via web-application parameters. Multiple connected sources confirm the issue and the impact (high/critical) with network access and low attack complexity, requiring low privileges and ...

CVE-2023-22585

The CVE-2023-22585 entry concerns the Danfoss AK-EM100 web applications, where the vulnerable component is the web application itself and the root cause is a Reflected Cross-Site Scripting vulnerability in the title parameter. This allows injection of malicious scripts when user-supplied input is...

CVE-2023-22586

CVE-2023-22586 concerns the Danfoss AK-EM100 web applications, where a vulnerability in the web app’s file parameter allows Local File Inclusion. The description is consistently reported across NVD/Red Hat/CVE lists as a Local File Inclusion issue affecting Danfoss AK-EM100. The connected sources...

PT-2023-18571 · Danfoss · Danfoss Ak-Em100

Name of the Vulnerable Software and Affected Versions: Danfoss AK-EM100 affected versions not specified Description: The issue concerns Local File Inclusion in the file parameter of the web application. This allows for potential access to sensitive files on the system. Recommendations: At the...

Danfoss AK-EM100 web applications 安全漏洞

Danfoss AK-EM100 web applications is a web application from Danfoss, Denmark. It provides a web-based graphical user interface to the store that allows a range of everyday users to locally or remotely monitor data, alarms and reports on all their refrigeration equipment. A security vulnerability...

Danfoss AK-EM100 web applications 跨站脚本漏洞

Danfoss AK-EM100 web applications is a web application from Danfoss, Denmark. It provides a web-based graphical user interface to the store that allows a range of everyday users to locally or remotely monitor data, alarms and reports on all their refrigeration equipment. A security vulnerability...

PT-2023-18570 · Danfoss · Danfoss Ak-Em100

Name of the Vulnerable Software and Affected Versions: Danfoss AK-EM100 affected versions not specified Description: The issue concerns Reflected Cross-Site Scripting in the title parameter of the web application. This allows for potential malicious script injection. Recommendations: At the momen...

Danfoss AK-EM100 web applications 信息泄露漏洞

Danfoss AK-EM100 web applications is a web application from Danfoss, Denmark. It provides a web-based graphical user interface to the store that allows a range of everyday users to locally or remotely monitor data, alarms, and reports on all of their refrigeration equipment. An information...

Amazon Linux AMI : mod_security (ALAS-2023-1763)

The version of modsecurity installed on the remote host is prior to 2.8.0-5.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1763 advisory. In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web...