An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LM_API/api/ConfigurationService/GetImages wit ...
Continue Reading
December 24, 2022
An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks all user passwords and MSSQL hashes via ...
Continue Reading
December 24, 2022
Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.Read More ...
Continue Reading
December 24, 2022
Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.Read More ...
Continue Reading
December 24, 2022
Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in some situations) and the WhoAmI endpoint (e.g., path disclo ...
Continue Reading
December 24, 2022
An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victim's account after the victim logged out - /LMS/LM/#main can ...
Continue Reading
December 24, 2022
GetFile.aspx in Planet eStream before 6.72.10.07 allows .. directory traversal to read arbitrary local files.Read More ...
Continue Reading
December 24, 2022
An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL ...
Continue Reading
December 24, 2022
Back to Main
