A CSRF vulnerability is found in the ABB Cylon FLXeon series. Exploitation is restricted due to the server's CORS configuration, which lacks Access-Control-Allow-Credentials. The exploit conditions include hosting the malicious page on the same domain, Man-in-the-Middle attacks, LAN access, subdomain hosting, and misconfigured CORS policies.
By tricking a user into visiting a malicious website, an attacker could exploit this vulnerability in IBM Security Verify Access 10.0.0 - 10.0.8 to redirect the user to a different site that appears legitimate, potentially leading to the disclosure of sensitive information or enabling further attacks.
An unauthenticated SQL Injection vulnerability is found in LearnPress WordPress Plugin versions up to 4.2.7. This flaw exists in the c_only_fields parameter of the LearnPress API endpoint, allowing attackers to execute malicious SQL commands through API requests without authentication. Successful exploitation could result in unauthorized database access, potential exposure of sensitive data, or even granting administrative control through database manipulation.
The script aims to exploit a vulnerability in a cluster manager by searching for a specific 'Alias' parameter in the href attribute of HTML links. If the parameter is found, the script proceeds with the exploitation process. It utilizes BeautifulSoup for parsing HTML content and requests library for making HTTP requests. The vulnerability can potentially lead to information disclosure.
The C program contains a buffer overflow vulnerability due to improper input validation. By sending a specially crafted input, an attacker can overwrite the buffer boundaries and inject malicious code. This can lead to arbitrary code execution and potentially compromise the system. This vulnerability can be identified as CVE-2021-12345.
The unauthenticated SQL Injection and path traversal vulnerabilities in xbtitFM 4.1.18 and prior versions can be exploited without user interaction. An insecure file upload vulnerability requires enabling the file_hosting feature, which can be achieved by accessing an administrator account. These vulnerabilities can allow an attacker to extract database names, user information, and password hashes. Automated tools like sqlmap can be used to exploit these vulnerabilities and dump the database.
Electrolink FM/DAB/TV Transmitter devices are prone to a credentials disclosure vulnerability. Attackers can exploit this issue to gain access to sensitive information such as login credentials. This vulnerability affects multiple versions of the Electrolink transmitters including Compact DAB Transmitter, Medium DAB Transmitter, High Power DAB Transmitter, Compact FM Transmitter, Modular FM Transmitter, Digital FM Transmitter, VHF TV Transmitter, and UHF TV Transmitter.
An attacker can bypass authentication on Electrolink FM/DAB/TV Transmitter devices due to a lack of proper authentication mechanisms. This vulnerability affects various models and versions of Electrolink transmitters, allowing unauthorized access to the devices.
The code snippet demonstrates a C program that establishes a socket connection to a remote device with IP address 192.168.1.10 on port 8888. It then sends a command 'id' to the device, which is executed with root privileges. This vulnerability could be exploited by an attacker to remotely execute arbitrary commands on the target device.
Electrolink FM/DAB/TV Transmitter devices with web version 01.09, 01.08, 01.07, display version 1.4, 1.2, control unit version 01.06, 01.04, 01.03, and firmware version 2.1 are vulnerable to a pre-authentication MPFS image remote code execution. An attacker could exploit this vulnerability to execute arbitrary code on the affected system.
Services By CQR