A.S. Watson Group : PII Disclosure At `theperfumeshop.com/register/forOrder`

A vulnerability was discovered that allowed unauthorized access to personally identifiable information of customers who placed orders on a website. By manipulating web requests, an attacker could view full name, address, phone number, order history and payment details of other customers. This...

Jenkins Plugin vRealize Orchestrator 跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins vRealize Orchestrator Plugin 3.0...

PT-2022-3909 · Robustel · Robustel R1510

Name of the Vulnerable Software and Affected Versions: Robustel R1510 version 3.3.0 Description: The issue is related to command injection vulnerabilities in the web server's ajax endpoints functionalities. A specially-crafted network packet can lead to arbitrary command execution. An attacker ca...

CVE-2022-31054 Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events

Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server wil...

GHSA-MQWH-R366-4224 Cabot Cross Site Scripting (XSS) vulnerability via Endpoint column

All versions up to 0.11.16 of package cabot are vulnerable to Cross-site Scripting XSS via the Endpoint column...

CVE-2022-30456

Badminton Center Management System 1.0 is vulnerable to Cross Site Scripting XSS via /bcms/classes/Master.php?f=savecourtrental...

smallrye-health-ui: persistent cross-site scripting in endpoint

It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks...

CVE-2022-29741

Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=deletefee...

Cross site scripting

A vulnerability was found in Bludit 3.13.1. It has been declared as problematic. This vulnerability affects the endpoint /admin/new-content of the New Content module. The manipulation of the argument content with the input alert1 leads to cross site scripting. The attack can be initiated remotely...

GHSA-W5M2-299G-RFF5 Page Compare Reflected Cross-site Scripting (XSS) vulnerability

Impact ACS Commons version 5.1.x and earlier suffers from a Reflected Cross-site Scripting XSS vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitized. An attacker must provide a...

CVE-2022-29603

A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint such as /api/students/me/messages/ to, for example, retrieve personal...

CVE-2022-28023

Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchaseorder/classes/Master.php?f=deletesupplier...

Ivanti Avalanche 路径遍历漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche 6.3.2, which stems from the imageFilePath parameter processed b...

CVE-2021-39876

Removed by vendor...

Maccms 跨站脚本漏洞

Maccms is a PHP-based film and television content management system CMS. v10 version of Maccms contains a cross-site scripting vulnerability, which originates from the lack of user-supplied data and output data validation filtering in the select and input parameters in...

CVE-2021-42853

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's DSA AgentDiagnosticServlet has directory traversal vulnerability at the "/api/appInternals/1.0/agent/diagnostic/logs" API. The affected endpoint does not have any input validation of the user's input that allows a...

FetLife: Race condition in endpoint POST fetlife.com/users/invitation, allow attacker to generate unlimited invites

This report describes the same bug as 1455487. I rewrite this bug here to make the report clearer. I will self-close 1455487 right now. Description The Invite Your Friend to Join FetLife feature is vulnerable to race condition. By sending many requests at the same time to endpoint POST...

Design/Logic Flaw

An issue was discovered in Delta RM 1.2. It is possible to request a new password for any other account using the account ID. Using the /listes/DTsendmaildata/admutilisateur/send-mail.json endpoint, a user can send a JSON array with user IDs that will have their passwords reset and new ones sent ...

U.S. Dept Of Defense: CVE-2021-42567 - Apereo CAS Reflected XSS on https://█████████

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints. CAS is vulnerable to a Reflected Cross-Site Scripting attack, via POST requests sent to the REST API endpoints. The payload could be injected on URLs: /███████/. Malicious scripts can be submitted to CAS via...

Uncovering and Defending Systems Against Attacks With Layers of Remote Control

The Trend Micro™ Managed XDR team addressed a stealthy multilayered attack that progressed from an exploited endpoint vulnerability to the use of legitimate remote access tools including Remote Desktop Protocol RDP as its final means of intrusion...