PT-2022-14227 · WordPress · Mobile Browser Color Select Plugin

Name of the Vulnerable Software and Affected Versions: Mobile browser color select plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is due to missing or incorrect nonce validation on the admin update data function, making it possible for unauthenticated attackers t...

CVE-2021-43937

Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request...

CVE-2021-36203

Summary of CVE-2021-36203 (Johnson Controls Metasys SCT/SCT Pro SSRF) : The vulnerability is a server-side request forgery (SSRF) that can let an attacker identify and forge requests to internal systems via a specially crafted request. Affected products: Metasys System Configuration Tool (SCT) an...

CVE-2021-4031

Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it. This could allow an attacker to forge a request and bypass the payment system by marking items as payed without any verification...

Mini-Inventory-and-Sales-Management-System 跨站请求伪造漏洞

Mini-Inventory-and-Sales-Management-System is an inventory and sales management system written in PHP codeIgniter with support for MySQL and Sqlite3 databases. A cross-site request forgery vulnerability exists in Mini-Inventory-and-Sales-Management-System version 1.0, which stems from...

WordPress plugin LiteSpeed Cache跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in versions of the WordPress LiteSpeed Cache plugin prior t...

The vulnerability of the h5-vcav-bootstrap-service software, a management software for virtual infrastructure of VMware vCenter Server, allows an attacker to read local files on the server where the vulnerable software is installed. It also enables the attacker to forge requests on the server side and perform XSS attacks.

The vulnerability of the h5-vcav-bootstrap-service plugin in the virtualization infrastructure management software is related to errors in processing relative pathnames to directories. Exploiting this vulnerability allows a malicious actor to read local files on the server where the vulnerable...

Apache Ozone 授权问题漏洞

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments, an authorization issue vulnerability exists in Apache Ozone, which stems from the product's failure to protect OM requests with valid privileges. An attacker could create a...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress suffers from a cross-site request forgery vulnerability that stems from the WEB applicatio...

Apache MINA 安全漏洞

Apache MINA is a web application framework from the Apache Foundation. A denial-of-service vulnerability exists in Apache MINA, which is caused by improper handling of HTTP message header requests in Apache MINA. An attacker could exploit this vulnerability to potentially cause an infinite loop i...

Ecoa Bas controller 跨站请求伪造漏洞

ECOA BAS controller is an intelligent lighting control solution. ECOA BAS controller is vulnerable to cross-site request forgery, which can be exploited by attackers to send forged requests to malicious web pages and execute CRUD commands to perform arbitrary actions on the system...

CVE-2021-41764

A cross-site request forgery CSRF vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a...

CVE-2021-23404

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Reques...

Argo Server TLS requests could be forged by attacker with network access

Impact We are not aware of any exploits. This is a pro-active fix. Impacted: You are running Argo Server = v3.0 with --secure unspecified note - running in secure mode is recommended regardless. The attacker is within your network. If you expose Argo Server to the Internet then "your network" is...

Argo Server TLS requests could be forged by attacker with network access

Impact We are not aware of any exploits. This is a pro-active fix. Impacted: You are running Argo Server = v3.0 with --secure unspecified note - running in secure mode is recommended regardless. The attacker is within your network. If you expose Argo Server to the Internet then "your network" is...

Esri Arcgis Server 代码问题漏洞

ArcGIS Server is the back-end server software component of ArcGIS Enterprise.ArcGIS Server Manager is an application that is installed with ArcGIS Server and provides an intuitive and convenient interface for managing the server. A server-side request forgery vulnerability exists in ArcGIS Server...

Design/Logic Flaw

FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely...

CVE-2021-27736

FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely...

CVE-2021-27736

FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely...

Anuko Time Tracker 跨站请求伪造漏洞

Anuko Time Tracker is a web platform used by the individual developers of Anuko to count employee time spent on projects. A security vulnerability exists in Anuko Time Tracker, which can be exploited to provide a form that can be used by an attacker to perform an unexpected action, such as changi...