Show filters
7 Total Results
Displaying 1-7 of 7
Sort by:
Attacker Value
Unknown
CVE-2022-26959
Disclosure Date: September 16, 2022 (last updated February 24, 2025)
There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The vulnerabilities exist in the userName parameter of the processlogin.jsp page in the /northstar/Portal/ directory and the userID parameter of the login.jsp page in the /northstar/iphone/ directory. Exploitation of the SQL injection vulnerabilities allows full access to the database which contains critical data for organization’s that make full use of the software suite.
0
Attacker Value
Unknown
CVE-2021-29398
Disclosure Date: February 04, 2022 (last updated February 23, 2025)
Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to browse and list the directories across the entire filesystem of the host of the web application.
0
Attacker Value
Unknown
CVE-2021-29397
Disclosure Date: February 04, 2022 (last updated February 23, 2025)
Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local user to intercept users credentials transmitted in cleartext over HTTP.
0
Attacker Value
Unknown
CVE-2021-29396
Disclosure Date: February 04, 2022 (last updated February 23, 2025)
Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities without authentication.
0
Attacker Value
Unknown
CVE-2021-29395
Disclosure Date: February 04, 2022 (last updated February 23, 2025)
Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to download arbitrary files, including JSP source code, across the filesystem of the host of the web application.
0
Attacker Value
Unknown
CVE-2021-29394
Disclosure Date: February 04, 2022 (last updated February 23, 2025)
Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST request.
0
Attacker Value
Unknown
CVE-2021-29393
Disclosure Date: February 04, 2022 (last updated February 23, 2025)
Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to inject and execute arbitrary system commands via the unsanitized user-controlled "command" and "commandvalues" parameters.
0
