9508 matches found
IBOS SQL注入漏洞
IBOS is a collaborative office management system. A SQL injection vulnerability exists in IBOS OA version 4.5.5, which stems from the fact that the file ?r=recruit/contact/export&contactids=x causes sql injection...
PT-2023-29550 · Ibos Oa · Ibos Oa
Name of the Vulnerable Software and Affected Versions: IBOS OA version 4.5.5 Description: A critical vulnerability was found in IBOS OA, affecting unknown code of the file ?r=recruit/contact/export&contactids=x. The manipulation leads to sql injection. The attack can be initiated remotely. The...
HackerOne: Names not completely redacted despite "Redact the names of the involved users" is selected
An edge case was discovered in the Export PDF function where names ending with a . were not properly redacted despite selecting the "Redact the names of the involved users" option. The vulnerability allowed for the disclosure of sensitive information...
CVE-2023-38422
Walchem Intuition 9 firmware versions prior to v4.21 are missing authentication for some of the API routes of the management web server. This could allow an attacker to download and export sensitive data...
Walchem Intuition 访问控制错误漏洞
Walchem Intuition is a controller from Walchem. An Access Control Error vulnerability exists in versions prior to Walchem Intuition 9 v4.21 that stems from a lack of authentication and could allow an attacker to download and export sensitive data...
Insufficient access control in the export functionality for the 'Groups' module exposing user password hashes
Description The web application incorrectly returns sensitive data to authenticated lower privileged users when making requests to export data from the 'Groups' module. This includes information such as the user's email address, password hash and whether two-factor authentication is configured...
CVE-2023-3435
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks...
CVE-2023-3259
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the...
Ecommerce Responsive 1.2 Insecure Direct Object Reference
==================================================================================================================================== | Title : Ecommerce Responsive v1.2 Insecure Direct Object Reference Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser :...
SUSE CVE-2023-37543
Cacti before 1.2.6 allows IDOR Insecure Direct Object Reference for accessing any graph via a modified localgraphid parameter to graphxport.php. This is a different vulnerability than CVE-2019-16723...
CVE-2023-4106 A guest user can perform various actions on public playbooks
Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks...
Mattermost Security Vulnerabilities
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from not properly checking if the requesting user is a guest guest user, which allows guest users to perform different operations on public...
CVE-2023-36313
PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting XSS via all post parameters of "Export Requests" aside from "requestfeed"...
CVE-2023-36313
PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting XSS via all post parameters of "Export Requests" aside from "requestfeed"...
CVE-2023-36313
PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting XSS via all post parameters of "Export Requests" aside from "requestfeed"...
Cross site scripting
PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting XSS via all post parameters of "Export Requests" aside from "requestfeed"...
DEBIAN-CVE-2023-37543
Cacti before 1.2.6 allows IDOR Insecure Direct Object Reference for accessing any graph via a modified localgraphid parameter to graphxport.php. This is a different vulnerability than CVE-2019-16723...
CVE-2023-37543
Cacti before 1.2.6 allows IDOR Insecure Direct Object Reference for accessing any graph via a modified localgraphid parameter to graphxport.php. This is a different vulnerability than CVE-2019-16723...
UBUNTU-CVE-2023-37543
Cacti before 1.2.6 allows IDOR Insecure Direct Object Reference for accessing any graph via a modified localgraphid parameter to graphxport.php. This is a different vulnerability than CVE-2019-16723...