242 matches found
CVE-2023-2326
The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF...
CVE-2022-25226
ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obtaining a valid SID without any kind of authentication. It is possible to achieve code execution on the server by sending keyboard or mouse events to the serve...
CVE-2022-39147
A vulnerability has been identified in Parasolid V33.1 All versions = V33.1.262 = V35.0.161 V35.0.164, Simcenter Femap V2022.1 All versions V2022.1.3, Simcenter Femap V2022.2 All versions V2022.2.2. The affected application is vulnerable to uninitialized pointer access while parsing specially...
CVE-2020-29042
An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that is protected by an access code...
CVE-2023-2334
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...
CVE-2023-2334
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...
CVE-2023-2334
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...
CVE-2023-2334
CVE-2023-2334 affects the edd-google-sheet-connector-pro WordPress plugin (< 1.4) and the Easy Digital Downloads Google Sheet Connector plugin (
CVE-2023-2334 Easy Digital Downloads Google Sheet Connector < 1.6.6 - Access Code Update via CSRF
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...
CVE-2023-2334: Cross-Site Request Forgery (CSRF)
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...
PT-2025-20996
Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Description: The issue is related to a use-after-free condition in Microsoft Office, allowing an unauthorized attacker to execute code locally. This can potentially enable remote attackers to...
CVE-2025-3711
The CVE-2025-3711 entry concerns the ATEN LCD KVM over IP Switch CL5708IM. Reported as a stack-based buffer overflow in firmware versions prior to v2.2.215, it allows unauthenticated remote attackers to execute arbitrary code on the device. Several connected sources corroborate a network-exposed ...
PT-2025-24452
Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description The issue resides within the System component of the Android operating system and is related to improper code generation management. Remote attackers may be able to execute arbitrary code by...
CVE-2025-31352
A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'UpdateGateways' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and...
CVE-2025-32846
A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'LockGeneralSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from...
CVE-2025-32872
TeleControl Server Basic (Siemens) prior to v3.1.2.2 contains SQL injection in the GetOverview path, enabling an authenticated remote attacker to bypass authorization, read/write the database and execute code with NT AUTHORITY\NetworkService permissions. Attack requires access to port 8000 where ...
CVE-2025-32867
A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'CreateBackup' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and...
CVE-2025-32844
CVE-2025-32844 affects Siemens TeleControl Server Basic (versions before 3.1.2.2). The vulnerability is an SQL injection in the UnlockUser method that can let an authenticated remote attacker bypass authorization, read/write the database, and execute code with NT AUTHORITY\NetworkService privileg...
CVE-2025-32837
A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'GetActiveConnectionVariables' method. This could allow an authenticated remote attacker to bypass authorization controls, to...