CVE-2022-22797

CVE-2022-22797 concerns Sysaid/Open Redirect via the parameter redirectURL in the GET request to a path like /CommunitySSORedirect.jsp?redirectURL=... Unvalidated redirects and forwards are possible when input is untrusted, enabling an attacker to redirect users to a malicious site and potentiall...

Royal Event Management System 1.0 SQL Injection

Exploit Title: Royal Event Management System 1.0 - 'todate' SQL Injection Authenticated Date: 2022-26-03 Exploit Author: Eren Gozaydin Vendor Homepage: https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html Software Link:...

CVE-2021-26363

A malicious or compromised UApp or ABL could potentially change the value that the ASP uses for its reserved DRAM, to one outside of the fenced area, potentially leading to data exposure...

CVE-2022-24042

CVE-2022-24042 affects Siemens Desigo DXR2, PXC3, PXC4, and PXC5 devices. The vulnerability is that the web application AuthToken does not expire after the defined auto logoff delay, enabling an attacker to capture a token and reuse old session credentials or session IDs for authorization. Affect...

College Management System SQL Injection Vulnerability

College Management System is a simple project. It is used to record students, instructors, subjects, schedules, and all things related to the university.College Management System v1.0 is vulnerable to a SQL injection vulnerability that stems from the coursecode parameter's lack of validation of...

F5 BIG-IP code issue vulnerability (CNVD-2022-79947)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. F5 BIG-IP has a code issue vulnerability that can be exploited by attackers to cause a denial of service on the BIG-IP system...

F5 BIG-IP multiple products have unspecified vulnerabilities

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. Several F5 BIG-IP products have security vulnerabilities that can be exploited by attackers to access certificate and key files from remote...

F5 BIG-IP log information leakage vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. F5 BIG-IP is vulnerable to log information disclosure, which could be exploited by an attacker to use or delete private keys by accessing a...

F5 BIG-IP Input Validation Error Vulnerability (CNVD-2022-79943)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. F5 BIG-IP has an input validation error vulnerability that could be exploited by an attacker to cause a denial of service on the BIG-IP syste...

Design/Logic Flaw

This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application...

Design/Logic Flaw

Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for any RubyGems.org user to remove and replace certain gems even if that user was not authorized to do so. To be vulnerable, a gem needed: one or more dashes i...

CVE-2022-29176 Unauthorized gem takeover for some gems on rubygems.org

Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for any RubyGems.org user to remove and replace certain gems even if that user was not authorized to do so. To be vulnerable, a gem needed: one or more dashes i...

CVE-2022-26890

On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Sessi...

CVE-2022-26890

On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Sessi...

F5 BIG-IP 跨站脚本漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. A cross-site scripting vulnerability exists in F5 BIG-IP, which can be exploited by attackers to execute JavaScript in the context of the...

GHSA-9HGC-WPC5-V8P9 An attacker can execute malicious javascript in Live Helper Chat

Cross-site Scripting XSS in GitHub repository livehelperchat/livehelperchat prior to 3.99v. Attacker can execute malicious javascript on application...

CVE-2022-24891

ESAPI The OWASP Enterprise Security API is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the antisamy-esapi.xml configurati...

Explaining Cloud Native Application Security

By Owais Sultan Securing applications on-premises and on the cloud are two entirely different processes. The cloud provides plenty of benefits… This is a post from HackRead.com Read the original post: Explaining Cloud Native Application Security...

Denial Of Service (DoS)

qemu is vulnerable to Denial Of Service DoS. It allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process causing an application crash...

CVE-2022-24891

CVE-2022-24891 affects ESAPI (antisamy-esapi.xml) where an incorrect regular expression for onsiteURL could allow JavaScript: URLs to escape proper sanitization. The issue is fixed in ESAPI 2.3.0.0; workaround is to manually edit antisamy-esapi.xml to adjust the onsiteURL regex. Connected sources...