Cisco Prime Collaboration Provisioning Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input...

PT-2021-7448

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE Software affected versions not specified Description A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker with...

CVE-2021-39180

OpenOLAT is a web-based learning management system LMS. A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user e.g. the tomcat user. Depending...

CVE-2021-39180

OpenOLAT is a web-based learning management system LMS. A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user e.g. the tomcat user. Depending...

CVE-2021-39180

OpenOLAT is affected by a path traversal vulnerability (CVE-2021-39180) in versions before 15.3.18, 15.5.3, and 16.0.0. An attacker with an OpenOLAT user account can upload a specially crafted ZIP and trigger unzip, enabling overwriting files writable by the application server user (e.g., Tomcat)...

CVE-2021-34578

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

CVE-2021-34578 WAGO: Authentication Vulnerability in Web-Based Management

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

Indexhibit Cross-Site Request Forgery Vulnerability (CNVD-2021-67907)

Indexhibit is a web-based content management system. A cross-site request forgery vulnerability exists in Indexhibit version 2.1.5. An attacker can exploit this vulnerability to arbitrarily delete an administrator account...

Zoho ManageEngine ADSelfService Plus Access Control Error Vulnerability

ZOHO zoho manageengine adselfservice plus is a web-based end-user password management software from ZOHO. zoho ManageEngine ADSelfService Plus 6103 and earlier versions are vulnerable to an access control error that could be exploited by an attacker via the X The vulnerability can be exploited to...

Indexhibit improper access control vulnerability

Indexhibit is a web-based content management system. An improper access control vulnerability exists in the /config/config.php component of Indexhibit version 2.1.5. An attacker could exploit this vulnerability to view arbitrary files...

Indexhibit Cross-Site Scripting Vulnerability (CNVD-2021-67909)

Indexhibit is a web-based content management system. A reflection-based cross-site scripting vulnerability exists in the /plugin/ajax.php component of Indexhibit version 2.1.5. An attacker could use this vulnerability to execute arbitrary web script or HTML...

Indexhibit Cross-Site Scripting Vulnerability

Indexhibit, a web-based content management system, is vulnerable to a stored cross-site scripting vulnerability in the Sections module in Indexhibit version 2.1.5. An attacker can exploit this vulnerability to execute arbitrary web script or HTML...

qdPM Cross-Site Scripting Vulnerabilities

qdPM is a web-based open source project management tool. A cross-site scripting vulnerability exists in qdPM 9.1, which stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

LedgerSMB Cross-Site Scripting Vulnerability (CNVD-2021-101203)

LedgerSMB is a free web-based double-entry bookkeeping system with quoting, ordering, invoicing, projects, time cards, inventory management, shipping, etc. A cross-site scripting vulnerability exists in LedgerSMB, which stems from the application's failure to check the origin of HTML fragments...

JetBrains Hub Licensing Issue Vulnerability (CNVD-2022-09225)

JetBrains Hub is a web-based application from JetBrains Czech Republic. The application is able to integrate multiple JetBrains team tools together. An authorization issue vulnerability exists in versions prior to JetBrains Hub 2021.1.13402, which stems from the fact that it is possible for the...

Brutus - An Educational Exploitation Framework Shipped On A Modular And Highly Extensible Multi-Tasking And Multi-Processing Architecture

An educational exploitation framework shipped on a modular and highly extensible multi-tasking and multi-processing architecture. Brutus: an Introduction Looking for version 1? See the branches in this repository. Brutus is an educational exploitation framework written in Python. It automates pre...

CVE-2021-34716 Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root user. This vulnerability is due to incorrec...

Simple Image Gallery Web App Access Control Error Vulnerability

Simple Image Gallery Web App is a web-based application that can be managed by multiple users. Users can store their images in this Web application.An access control error vulnerability exists in Simple Image Gallery Web App, which stems from an unrestricted file upload of Simple Image Gallery We...

Nagios XI file inclusion vulnerability

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting, and rich data visualization.A local file inclusion vulnerability exists in versions of Nagios XI prior to 5.8.5. The vulnerability stems from an improper...

ZOHO ManageEngine ADSelfService Plus CSV Injection Vulnerability

ZOHO ManageEngine ADSelfService Plus is a web-based end-user password management software from ZOHO, Inc. A CSV injection vulnerability exists in ZOHO ManageEngine ADSelfService Plus, which can be exploited by attackers to obtain a reverse shell...