1628 matches found
Cross site request forgery (csrf)
An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...
PT-2022-23518 · Zkteco · Zkbio Cvsecurity V5000
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBioSecurity V5000 version 3.0.5 r Description: An access control issue allows attackers to arbitrarily create admin users via a crafted HTTP request. Recommendations: For ZKTeco ZKBioSecurity V5000 version 3.0.5 r, consider restricti...
CVE-2022-36634
An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...
CVE-2022-36634
CVE-2022-36634 affects ZKTeco ZKBioSecurity V5000, specifically version 3.0.5_r, where an access control flaw allows an attacker to arbitrarily create administrator users via a crafted HTTP request. The vulnerability is described as improper access control in the web-based ZKBioSecurity platform,...
OrchardCore vulnerable to HTML injection
OrchardCore versions starting with 1.0.0-rc1-11259 and prior to 1.4.0 are vulnerable to HTML injection. The vulnerability allows an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users. Version 1.4.0...
CVE-2022-32173
In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users...
Input validation
In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users...
CVE-2022-32173
The CVE pertains to OrchardCore versions rc1-11259 through v1.2.2, where an authenticated user with an editor role can inject a persistent HTML modal into the dashboard, potentially affecting admin users due to insufficient input filtering/escaping. Root cause: lack of proper sanitization in edit...
CVE-2022-32173 OrchardCore - HTML Injection
In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users...
CVE-2022-32173 OrchardCore - HTML Injection
In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users...
PT-2022-18535 · WordPress · Wp Socializer
Name of the Vulnerable Software and Affected Versions: WP Socializer versions prior to 7.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for example, in a...
Rdiffweb 安全漏洞
Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. Provides quick access to your archives through an efficient web interface. A denial of service vulnerability exists in Rdiffweb versions prior to 2.4.8, which stems from a lack of length validation of the root...
Security Bulletin: Some IBM Sterling Order Management APIs may return database sensitive information (CVE-2013-0578)
Abstract Some IBM Sterling Order Management APIs may return database sensitive information when API tester is deployed in the environment. Content VULNERABILITY DETAILS: DESCRIPTION: Some IBM Sterling Order Management APIs can return database sensitive user information when used in API tester. Al...
CVE-2022-2567
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2022-17449 · WordPress · Form Builder
Name of the Vulnerable Software and Affected Versions: Form Builder CP WordPress plugin versions prior to 1.2.32 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some form settings are not properly sanitis...
CVE-2022-2635
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2022-2635
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2022-28272 · Pageflow · Pageflow
Name of the Vulnerable Software and Affected Versions: Pageflow versions prior to 14.5.2 Pageflow versions prior to 15.7.1 Description: The issue allows attackers to update membership objects associated with their own account to be associated with a different account, potentially compromising all...
CVE-2022-28169 - Brocade Fabric OS Privilege Escalation Vulnerability (BSA-2022-2075)
Security Advisory ID : BSA-2022-2075 Component : Webtools Revision : 3.1 Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege webtools user to gain elevated admin rights, or privileges, beyond what is intended or...