CVE-2022-37772

Maarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts due to excessive verbose responses from the application. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to compromised accounts...

CVE-2022-44004

An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for any account and set a new password...

UBUNTU-CVE-2022-3726

Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick a user to click on the Swagger OpenAPI viewer and issue HTTP requests that affect the victim's account...

XSS Stored inside help links onevent attribute

📜 Description Cross-site scripting XSS is a type of security vulnerability that can be found in some web applications. XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users. The persistent or stored XSS vulnerability is a more devastating variant of a...

CVE-2022-40289

The application was vulnerable to an authenticated Stored Cross-Site Scripting XSS in the upload and download functionality, which could be leveraged to escalate privileges or compromise any accounts they can coerce into observing the targeted files...

CVE-2022-40287

The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting XSS vulnerability in messaging functionality, leading to privilege escalation or a compromise of a targeted account...

CVE-2022-40289

PHP Point of Sale (version 19.0) is affected by an authenticated Stored Cross-Site Scripting (XSS) in the upload/download functionality. The underlying issue allows an attacker to escalate privileges or compromise accounts of users who observe the targeted files. The reports consistently describe...

CVE-2022-40288

The CVE-2022-40288 entry refers to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in PHP Point of Sale, specifically affecting version 19.0 by PHP Point of Sale, LLC. The flaw resides in user profile data fields and can be leveraged to escalate privileges within the application ...

PT-2022-25322 · Php Point Of Sale Llc +1 · Php Point Of Sale

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The application is vulnerable to an authenticated Stored Cross-Site Scripting XSS issue in its messaging functionality. This could lead to privilege...

PT-2022-25323 · Php Point Of Sale Llc +1 · Php Point Of Sale

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The application is vulnerable to an authenticated Stored Cross-Site Scripting XSS issue in the user profile data fields. This could be used to escalate privileges within the...

CVE-2022-3741 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output...

CVE-2022-3741 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output...

CVE-2022-3741

CVE-2022-3741 affects chatwoot/chatwoot and is described as an improper restriction of excessive authentication attempts. The connected documents provide concrete details: the issue enables DoS via account generation under resource constraints, with the ability to identify output Status Codes to ...

PT-2022-23980 · Chatwoot +1 · Chatwoot +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue affects account generation and sign-in directories. It may be possible to create a denial-of-service DoS event in the server by generating...

CVE-2022-3741 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output...

Credential stuffers take aim at Final Fantasy XIV players

Square Enix, the company behind video games like Final Fantasy XIV, reports that a third party is attempting to gain access to its Account Management System. How is this happening, and what are the risks? More importantly, what do you need to do to ensure your accounts are safe from harm?...

Developer account body snatchers pose risks to the software supply chain

Over the past several years, high-profile software supply chain attacks have increased in frequency. These attacks can be difficult to detect and source code repositories became a key focus of this research. Developer account takeovers present a substantial risk to the software supply chain becau...

CVE-2022-3255 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify...

GHSA-QCQV-38JG-2R43 Pageflow vulnerable to insecure direct object reference in membership update endpoint

Impact Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the manager role to including their own. While the Entity dropdown select field is greyed out in the UI, an attacker can use tools which allow sending...

Pageflow vulnerable to insecure direct object reference in membership update endpoint

Impact Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the manager role to including their own. While the Entity dropdown select field is greyed out in the UI, an attacker can use tools which allow sending...