5688 matches found
Remote code execution
PayMoney 3.3 is vulnerable to Client Side Remote Code Execution RCE. The vulnerability exists on the reply ticket function and upload the malicious file. A calculator will open when the victim who download the file open the RTF file...
CVE-2022-37140
CVE-2022-37140 affects PayMoney 3.3. The vulnerability is a Client-Side Remote Code Execution (RCE) in the reply ticket function through uploading a malicious file; when an affected user opens the crafted RTF, a calculator is launched. Multiple sources (NVD, Red Hat, CVE lists) describe this entr...
PCI DSS Tackles Client-Side Attacks: Everything You Need to Know About Complying With PCI 6.4.3
Client-side attacks often referred to as Magecart attacks have been around since as early as 2015 and dramatically gained in popularity when the global pandemic accelerated digital transformation, by driving more people and data online. Now the fight against these attacks is stepping up a notch...
GitLab: Bypass: Stored-XSS with CSP-bypass via scoped labels' color
A Stored-XSS with CSP-bypass vulnerability was discovered in GitLab that allowed attackers to execute arbitrary actions on behalf of victims at the client side. The vulnerability was caused by a missing mitigation for scoped labels, which allowed attackers to create a Stored-XSS with CSP-bypass o...
The vulnerability of the microprogramming software of the Cognex 3D-A1000 Dimensioning System, related to the implementation of security functions at the client-side, allows attackers to exploit their privileges.
The vulnerability of the microprogramming software of the Cognex 3D-A1000 Dimensioning System is related to the implementation of security functions at the client side. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
CVE-2022-1525
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, which could allow attackers to bypass web access controls by inspecting and modifying the source code of password protected web elements...
Code injection
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, which could allow attackers to bypass web access controls by inspecting and modifying the source code of password protected web elements...
CVE-2022-1525 Cognex 3D-A1000 Dimensioning System Client-Side Enforcement of Server-Side Security
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, which could allow attackers to bypass web access controls by inspecting and modifying the source code of password protected web elements...
PT-2022-4702 · Cognex · Cognex 3D-A1000 Dimensioning System
Name of the Vulnerable Software and Affected Versions: Cognex 3D-A1000 Dimensioning System versions 1.0.3 3354 and prior Description: The issue is related to the implementation of security functions on the client-side of the Cognex 3D-A1000 Dimensioning System. This could allow a remote attacker ...
Cognex 3D-A1000 Dimensioning System
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely, low attack complexity Vendor: Cognex Equipment: 3D-A1000 Dimensioning System Vulnerabilities: Missing Authentication for Critical Function, Improper Output Neutralization for Logs, Client-side Enforcement of Server-side Security 2...
Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Stored XSS
The plugin does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made As unauthenticated, make a reservation ie on a page where the reservationform is embed and...
EMC Data Protection Advisor < 19.7 Build B4 XSS (DSA-2022-107)
According to its self-reported version, the application is below version 19.7 Build B4. It is, therefore, affected by a stored cross-site scripting vulnerability. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context ...
CVE-2022-33935
Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data stor...
CVE-2022-33935
Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data stor...
Cross site scripting
Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data stor...
CVE-2022-33935
Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data stor...
CVE-2022-33935
Summary: CVE-2022-33935 affects Dell EMC Data Protection Advisor versions 19.6 and earlier and is a stored cross-site scripting (XSS) vulnerability in the web data store component. An attacker could cause the browser to execute malicious HTML/JavaScript in the context of the vulnerable web applic...
CVE-2021-3859
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks...
