ECHO-2654-D857-4161

Bulletin has no description...

EUVD-2026-4161

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows SQL Injection.This issue affects Hotel Guest Hotspot: through 22012026. NOTE: The vendor was contacted early about this...

CVE-2014-4161

Cross-site scripting XSS vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management SRM allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2009-4161

Cross-site scripting XSS vulnerability in the AN Search it! ansearchit extension 2.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2022-4161

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cgcopystart POST parameter before concatenating it to an SQL query in copy-gallery-images.php. This may allow malicious users with at least author privilege to leak sensiti...

CVE-2025-4161

A vulnerability classified as critical has been found in PCMan FTP Server up to 2.0.7. This affects an unknown part of the component VERBOSE Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and...

CVE-2025-4161 PCMan FTP Server VERBOSE Command buffer overflow

A vulnerability classified as critical has been found in PCMan FTP Server up to 2.0.7. This affects an unknown part of the component VERBOSE Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and...

CVE-2024-4161

In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information...

CVE-2024-4161

In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information...

CVE-2024-4161 Syslog traffic sent in clear-text

In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information...

CVE-2024-4161

CVE-2024-4161 affects Brocade SANnav prior to version 2.3.0, where syslog traffic is transmitted in clear text. This enables an unauthenticated, remote attacker to capture sensitive information via the syslog channel. The issue is documented across multiple sources (NVD/NVD, Red Hat, Broadcom adv...

CVE-2024-4161 Syslog traffic sent in clear-text

In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information...

Rocky Linux 8 : python-jinja2 (RLSA-2021:4161)

The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2021:4161 advisory. - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator and its use of multiple...

SUSE SLES12 Security Update : fwupdate (SUSE-SU-2023:4161-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4161-1 advisory. - rebuild the package with the new secure boot key bsc1209188. Tenable has extracted the preceding description block directly from the SUSE...

CVE-2023-4161

creationtimestamp| type| source ---|---|--- 2023-08-31 12:13:07+00:00| seen| https://t.me/cibsecurity/69529...

CVE-2023-4161

CVE-2023-4161 concerns the WordPress plugin WooCommerce PDF Invoice Builder . Multiple sources confirm a Cross‑Site Request Forgery (CSRF) vulnerability caused by a missing nonce check in the SaveCustomField function, affecting versions up to and including 1.2.90. Unauthenticated attackers could ...

CVE-2023-4161 WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can tric...

WordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.90 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce PDF Invoice Builder Type Plugin Vulnerable versions = 1.2.90 Fixed in 1.2.91 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-4161 Patch priority Low CVSS severity Low 4.3 Developer Edgar Rojas PSID 9cbed5bb67a7 Credits Marco...

Moxa MGate Protocol Gateways Cleartext Transmission of Sensitive Information (CVE-2021-4161)

The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server. This plugin only works with Tenable.ot. Please visit...

CVE-2022-4161 Contest Gallery < 19.1.5 - Author+ SQL Injection

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cgcopystart POST parameter before concatenating it to an SQL query in copy-gallery-images.php. This may allow malicious users with at least author privilege to leak sensiti...