10304 matches found
Design/Logic Flaw
NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid callbackUrl query parameter, which internally is converted to a URL object. The URL instantiation would fail due ...
CVE-2022-31093 Improper Handling of `callbackUrl` parameter in next-auth
NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid callbackUrl query parameter, which internally is converted to a URL object. The URL instantiation would fail due ...
Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.5 security updates and bug fixes
Red Hat Advanced Cluster Management for Kubernetes 2.4.5 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...
Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site Scripting
The plugin does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=advanceddbcleanertab=croncat=all&" Other pages are affected...
Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site Scripting
The plugin does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=advanceddbcleaner&aDBctab=cron&aDBccat=all&"alert/XSS/ Other pages are affected...
CVE-2022-31767
IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980...
CVE-2022-31767
CVE-2022-31767 affects IBM CICS TX Standard and Advanced 11.1, enabling remote arbitrary command execution via a specially crafted request. Root cause is a vulnerability in handling requests that allows code execution. The IBM security bulletins for Standard and Advanced 11.1 describe interim fix...
The vulnerability of AMD processor-based LFENCE/JMP modules allows attackers to disclose protected information.
The vulnerability of AMD’s LFENCE/JMP processors lies in the characteristics of the branch prediction module’s operation. Exploiting this vulnerability allows an attacker to gain access to protected memory from a program that does not have the necessary privileges, by using the mechanism for...
The Inevitable Need for Advanced Vulnerability Management
We have read enough and more news in recent times on the surge in cyberattacks. It is crystal clear that attackers are not leaving out even the tiniest of security loopholes and are coming up with smarter ways to invade our IT network. Vulnerability management is the most crucial cyber defense...
Malicious code in advanced-wp-debugger (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fef1ec84f4bb1ea8fbe94dcf92aaf76599a7124588be3dd18e000aff7b89c0e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Advanced School Management System SQL Injection Vulnerability (CNVD-2022-68965)
Advanced School Management System is a school management system developed by Angel Jude Reyes Suarez. v1.0 of Advanced School Management System is vulnerable to SQL injection, which originates from /school/model /gettimetable.php?id=The page lacks validation for external SQL statements, which cou...
The vulnerability of the Advanced Local Procedure Call (ALPC) handler in the Windows operating system allows attackers to escalate their privileges.
The vulnerability of the Advanced Local Procedure Call ALPC in the Windows operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...
The vulnerability of the Region Mapping sub-component of the Oracle Advanced Outbound Telephony component of the Oracle E-Business Suite allows a malicious actor to gain access to read, modify, add, or delete data.
The vulnerability of the User Interface sub-component of the Oracle Advanced Outbound Telephony component in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain access to read, modify, add, ...
The vulnerability of the SDK client integration component of the Oracle Advanced Outbound Telephony component of the Oracle E-Business Suite allows a malicious actor to gain access to read, modify, add, or delete data.
The vulnerability of the SDK client integration component of the Oracle Advanced Outbound Telephony component of the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read,...
CVE-2022-32371
itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/getteacher.php?id=...
CVE-2022-32372
itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/getsubject.php?id=...
Sql injection
itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/getclassroom.php?id=...
CVE-2022-32372
Affected software : itsourcecode Advanced School Management System v1.0 (open source PHP/MySQL-based). Vulnerability : SQL Injection via /school/model/get_subject.php?id= (unsafely handling user input in a SQL query). Root cause : input parameter not sanitized/filtered before database query. Impa...
