CVE-2022-25626

An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session...

ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup

The plugin does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs. Run the below command in the developer console of the web browser while being on the blog as a subscribe...

CVE-2022-25628

An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...

CVE-2022-25627

An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4...

CVE-2022-25628

An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4...

NETGEAR Nighthawk 操作系统命令注入漏洞

The NETGEAR Nighthawk WiFi6 Router is a series of routers that support WiFi 6 technology and are designed for users who are looking for a high-speed Internet experience. The NETGEAR Nighthawk WiFi6 Router suffers from a command injection vulnerability that stems from the fact that the default...

nodejs: Prototype pollution via console.table properties

Due to the formatting logic of the "console.table" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has...

Storefront Console crashes when clicking configuration at node Manage Receiver for Web sites

Storefront Console crashes when clicking configuration at node Manage Receiver for Web sites.The Store Front has successfully upgraded from 7.15 to 2203 LTSR...

CVE-2021-41943

Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action - Create a new Contextualize Action - Inject your HTML tag in the name field...

CVE-2021-41943

Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action - Create a new Contextualize Action - Inject your HTML tag in the name field...

Hardcoded credentials

Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action - Create a new Contextualize Action - Inject your HTML tag in the name field...

PT-2022-37537 · Red Hat · Spacewalk-Java +1

Name of the Vulnerable Software and Affected Versions: spacewalk-java versions 4.2.44-1 and earlier spacewalk-web versions 4.2.31-1 and earlier Description: The issue concerns the disclosure of the Proxy password in the browser console log. This problem is resolved by updating the affected...

Logrhythm 跨站脚本漏洞

Logrhythm is a software that collects, detects, alerts, and notifies about threat factors in a cluster from Logrhythm, Inc. in the United States. A security vulnerability exists in Logrhythm Web Console version 7.4.9. An attacker can exploit the vulnerability to inject HTML markup in the name fie...

PT-2022-11513 · Logrhythm · Logrhythm Web Console

Name of the Vulnerable Software and Affected Versions: Logrhythm Web Console version 7.4.9 Description: The issue allows for HTML tag injection through the Contextualize Action feature by creating a new Contextualize Action and injecting an HTML tag in the name field. Recommendations: For Logrhyt...

CVE-2021-41943

Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action - Create a new Contextualize Action - Inject your HTML tag in the name field...

CVE-2021-41943

CVE-2021-41943 affects Logrhythm Web Console 7.4.9, where HTML tag injection is possible in the Contextualize Action name field. The root cause is injection of HTML markup into that field, enabling potential HTML-based manipulation. The sources do not provide exploit details or a fixed patch/vers...

CVE-2021-41943

Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action - Create a new Contextualize Action - Inject your HTML tag in the name field...

nodau SQL注入漏洞

nodau is a simple console-based note-taking program by the individual developer TicklishHoneyBee. A security vulnerability exists in nodau, which stems from the fact that incorrect manipulation of the parameter value/name can lead to sql injection...

Buffalo network devices 操作系统命令注入漏洞

Buffalo network devices are a family of network devices from the Japanese company Buffalo. Buffalo network devices are vulnerable to an operating system command injection vulnerability that can be exploited by an authenticated attacker to execute arbitrary system commands or access the management...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty may affect IBM Spectrum Protect for Workstations Central Administration Console (CVE-2022-34165)

Summary IBM Spectrum Protect for Workstations Central Administration Console requires the dependent product IBM WebSphere Application Server Liberty. Information about a security vulnerability affecting IBM WebSphere Application Server Liberty has been published in a security bulletin. Refer to t...