250 matches found
PT-2024-5208
Name of the Vulnerable Software and Affected Versions: CocoaPods affected versions not specified Description: The issue is related to the CocoaPods dependency manager, specifically affecting older pods that migrated from the pre-2014 pull request workflow to trunk. If a pod had never been claimed...
CVE-2024-6160 SQL Injection in MegaBIP
SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages. This issue affects MegaBIP software versions through 5.12.1...
CVE-2024-6160 SQL Injection in MegaBIP
SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages. This issue affects MegaBIP software versions through 5.12.1...
CVE-2024-37177 Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation
SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause significant impact to confidentiality and...
CVE-2024-5607
The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers,...
PT-2024-40059 · Typo3 · Typo3 Neos
Name of the Vulnerable Software and Affected Versions: TYPO3 Neos affected versions not specified Description: A privilege escalation issue has been discovered, allowing logged-in editors to access, create, and modify content nodes that exist in the workspace of other editors. Recommendations: At...
Nix Security Vulnerabilities
Nix is a powerful package manager from Nix open source. It is used for making packages. A security vulnerability exists in Nix 2.20.3 and earlier versions, which stems from the fact that a fixed-output derivation on Linux can send a file descriptor from Nix storage to another program running on t...
MTN Group: Insecure direct Object Reference(Horizontal Escalation)
The vulnerability allowed for insecure direct object reference horizontal escalation. Specifically, the user's dashboard was accessed without authentication, and the text content was modified through client-side inspection and manipulation...
GHSA-6PGR-J9V4-XFVV ThingsBoard Server-Side Template Injection
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...
Rockstar Games: Exposed CDN access token allows modification of all newly uploaded Snapmatic photos
A CDN access token was exposed that allowed modification of newly uploaded Snapmatic photos in GTA5. This provided a brief window to alter content after uploading. The issue was fixed by removing the exposed CDN fields...
CVE-2023-30949
A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks...
Input validation
A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks...
CVE-2023-30949 CVE-2023-30949
A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks...
PT-2023-23079 · Slate · Slate
Name of the Vulnerable Software and Affected Versions: Slate affected versions not specified Description: A missing origin validation in the Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks. Recommendations: At the moment, the...
Slate 访问控制错误漏洞
slate is an extensible WYSIWYG web application from slate for quickly creating interactive, data-driven web pages. A security vulnerability exists in Slate versions prior to 6.207.0, which stems from a lack of source validation in the sandbox that could be exploited by a malicious user to modify...
CVE-2023-30949: Improper Use of Validation Framework
A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks...
The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, arises from the lack of measures taken to protect the SQL query structure. This allows attackers to modify or delete any content they desire.
The vulnerability of the StruxureWare Data Center Expert monitoring system relates to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to modify or delete any content at will...
PT-2023-3494 · Schneider Electric · Struxureware Data Center Expert
Name of the Vulnerable Software and Affected Versions: StruxureWare Data Center Expert affected versions not specified Description: A SQL Injection vulnerability exists due to improper neutralization of special elements in SQL commands, allowing an authenticated user to access, change, or delete...
Mars: Html injection
The consultant identified that the show parameter can reflect into the HTML page. An attacker could have crafted a malicious query that resulted in the inclusion of attacker-controlled HTML elements on the web page, changing the content presented to users. The vulnerability was assessed to have a...
