232 matches found
Avaya Spaces 安全漏洞
Avaya Spaces is a cloud-based team collaboration tool from Avaya. A security vulnerability exists in Avaya Spaces. An attacker exploiting the vulnerability could modify page content or disclose sensitive information...
CVE-2024-12756: Improper Validation of Specified Type of Input
An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user...
CVE-2025-1108 Insufficient data authenticity vulnerability in Janto
Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the vulnerability, the attacker must create a POST request by injecting malicious content into...
CVE-2024-12781 Aurum - WordPress & WooCommerce Shopping Theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import
The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'lab1cldemoinstallpackagecontent' function in all versions up to, and including, 4.0.2. This makes it possible for authenticated...
PT-2024-37870 · Baxter · Baxter Connex
Name of the Vulnerable Software and Affected Versions: Baxter Connex health portal versions prior to 8/30/2024 Description: An improper access control issue exists in the Baxter Connex health portal, which could allow an unauthenticated attacker to gain unauthorized access to the portal's databas...
Baxter Connex Health Portal 安全漏洞
The Baxter Connex Health Portal is a web portal for medical instruments from Baxter USA. A security vulnerability exists in the Baxter Connex Health Portal that stems from the inclusion of an improper access control vulnerability that could allow an unauthenticated attacker to gain unauthorized...
WordPress plugin Carousel Slider 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
CVE-2024-45321
A flaw was found in App::cpanminus cpanm through version 1.7047. The default configuration downloads Perl modules from CPAN using HTTP, which could allow an attacker to view or modify the content without the knowledge of the user. This issue could allow an attacker to execute malicious code if th...
PT-2024-18436 · WordPress · Brizy
Name of the Vulnerable Software and Affected Versions: Brizy – Page Builder plugin for WordPress versions up to, and including, 2.4.44 Description: The issue allows authenticated attackers with contributor access and above to modify the content of arbitrary published posts due to a missing...
PT-2024-5208
Name of the Vulnerable Software and Affected Versions: CocoaPods affected versions not specified Description: The issue is related to the CocoaPods dependency manager, specifically affecting older pods that migrated from the pre-2014 pull request workflow to trunk. If a pod had never been claimed...
CVE-2024-6160 SQL Injection in MegaBIP
SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages. This issue affects MegaBIP software versions through 5.12.1...
CVE-2024-6160 SQL Injection in MegaBIP
SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages. This issue affects MegaBIP software versions through 5.12.1...
CVE-2024-37177 Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation
SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause significant impact to confidentiality and...
CVE-2024-5607
The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers,...
PT-2024-40059 · Typo3 · Typo3 Neos
Name of the Vulnerable Software and Affected Versions: TYPO3 Neos affected versions not specified Description: A privilege escalation issue has been discovered, allowing logged-in editors to access, create, and modify content nodes that exist in the workspace of other editors. Recommendations: At...
Nix Security Vulnerabilities
Nix is a powerful package manager from Nix open source. It is used for making packages. A security vulnerability exists in Nix 2.20.3 and earlier versions, which stems from the fact that a fixed-output derivation on Linux can send a file descriptor from Nix storage to another program running on t...
MTN Group: Insecure direct Object Reference(Horizontal Escalation)
The vulnerability allowed for insecure direct object reference horizontal escalation. Specifically, the user's dashboard was accessed without authentication, and the text content was modified through client-side inspection and manipulation...
GHSA-6PGR-J9V4-XFVV ThingsBoard Server-Side Template Injection
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...
Rockstar Games: Exposed CDN access token allows modification of all newly uploaded Snapmatic photos
A CDN access token was exposed that allowed modification of newly uploaded Snapmatic photos in GTA5. This provided a brief window to alter content after uploading. The issue was fixed by removing the exposed CDN fields...