SAP PowerDesigner 访问控制错误漏洞

SAP PowerDesigner is a database design software from SAP Germany. SAP PowerDesigner suffers from an Access Control Error vulnerability that arises from having incorrect access control and can be exploited by an unauthenticated attacker to run arbitrary queries against the backend database via a...

Denial Of Service (DoS)

qemu is vulnerable to Denial of Service DoS attacks. Because hot-unplug is async, a race condition can occur in which the net device backend is cleared before the virtio-net pci frontend is removed. This time window might be used by a malicious attacker to trigger an assertion and cause a denial ...

CVE-2023-37497

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks XXE against the backend service...

CVE-2023-37497 An XML External Entity (XXE) Injection Vulnerability affects HCL Unica Platform

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks XXE against the backend service...

CVE-2023-37497 An XML External Entity (XXE) Injection Vulnerability affects HCL Unica Platform

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks XXE against the backend service...

HCL Unica Platform Code Issue Vulnerability

HCL Technologies HCL Unica Platform is a state-of-the-art enterprise automated marketing platform from HCL Technologies, USA. No manual effort is required to handle routine marketing tasks and capture the most effective leads. A security vulnerability exists in HCL Unica Platform versions 12.x...

PT-2023-20635 · Unknown · Cacheservice

Name of the Vulnerable Software and Affected Versions: Cacheservice affected versions not specified Description: The issue arises when Cacheservice is configured to use a sproxyd object-storage backend, allowing it to follow HTTP redirects issued by that backend. An attacker with access to a loca...

CVE-2023-36942

A cross-site scripting XSS vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the website title field...

CVE-2023-38495

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered...

CVE-2023-38495

Crossplane versions prior to 1.11.5, 1.12.3, and 1.13.0 have a flaw in the image backend where the byte contents of packages are not validated, allowing tampering to go undetected. The vulnerability is fixed in 1.11.5, 1.12.3, and 1.13.0. Workarounds include using images from trusted sources and ...

VulnCheck KEV: CVE-2022-0732

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability...

Cross-site Scripting (XSS)

contao/core-bundle is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of a validation in the input unit widget, which allows an attacker to inject and execute malicious Javascript into the browser and backend server...

Design/Logic Flaw

Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview back end an...

CVE-2023-36806 Contao cross site scripting vulnerability via input unit widget

Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview back end an...

CVE-2023-36806 Contao cross site scripting vulnerability via input unit widget

Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview back end an...

CVE-2023-36806

Contao XSS via input unit widget (CVE-2023-36806) affects Contao CMS versions prior to 4.9.42, 4.13.28, and 5.1.10 where untrusted backend users can inject code into headline fields, executed in backend previews and on the frontend. Root cause: lack of input validation in the widget used for head...

CVE-2023-36806 Contao cross site scripting vulnerability via input unit widget

Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview back end an...

Cross site scripting via input unit widget

Impact Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview back end and on the website front end. Patches Update to Contao 4.9.42, 4.13.28 or 5.1.10. Workarounds Disable login for all untrusted back end users. References...

PT-2023-25700 · Contao · Contao

Name of the Vulnerable Software and Affected Versions: Contao versions 4.0.0 through 4.9.41 Contao versions 4.13.0 through 4.13.27 Contao versions 5.0.0 through 5.1.9 Description: Contao is an open source content management system. It is possible for untrusted backend users to inject malicious co...

Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection Vulnerability

Exploit Title: Wifi Soft Unibox Administration 3.0 & 3.1 Login Page - Sql Injection Google Dork: intext:"Unibox Administration 3.1", intext:"Unibox 3.0" Exploit Author: Ansh Jain @sudoark Author Contact : email protected Vendor Homepage: https://www.wifi-soft.com/ Software Link:...