CVE-2022-30229

A vulnerability has been identified in SICAM GridEdge Classic All versions V2.6.6. The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to change data of a user, such as credentials, in case that user's id is known...

MAL-2022-6313 Malicious code in storage-image-processing-api-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd5fe1baa5d2f967fe24f1b3fdde3e077e889cdf7fc65c779ecd2a002bb2de8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Siemens SICAM GridEdge Essential 访问控制错误漏洞

SICAM GridEdge enables IoT functionality in your existing IEC 61850 devices with just a few clicks.An authentication error vulnerability in Siemens SICAM GridEdge results from the fact that the affected software does not authenticate access to privileged functions, which can be exploited to creat...

Siemens SICAM GridEdge Essential 授权问题漏洞

SICAM GridEdge enables IoT functionality in your existing IEC 61850 devices with just a few clicks.Siemens SICAM GridEdge is vulnerable to an authentication error, which stems from the fact that the affected software does not require authenticated access to privileged functions and can be exploit...

CVE-2022-1656

Vulnerable versions of the JupiterX Theme =2.0.6 allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterxapiajax actions registered by the JupiterX Core Plugin =2.0.6. This includes the...

CVE-2022-0885

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments...

Authorization

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments...

Design/Logic Flaw

Vulnerable versions of the JupiterX Theme =2.0.6 allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterxapiajax actions registered by the JupiterX Core Plugin =2.0.6. This includes the...

CVE-2022-0885 Member Hero <= 1.0.9 - Unauthenticated RCE

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments...

Exploit for CVE-2022-26809

PoC-CVE-2022-26809 PoC for CVE-2022-26809, analisys and consi...

WordPress plugin Member Hero 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

The vulnerability of SonicWall SMA 1000 series network firewall microprogramming software, related to access control deficiencies, allows attackers to gain unauthorized access to limited functions.

The vulnerability of SonicWall SMA 1000 series network firewall microprogramming software is related to access control deficiencies. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to limited functions of the system...

CVE-2022-30717

Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink...

CVE-2022-30717

Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink...

CVE-2022-30717

Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink...

CVE-2022-30717

The CVE-2022-30717 entry concerns Samsung AR Emoji prior to SMR Jun-2022 Release 1, with an underlying issue described as an improper caller check. The vulnerability allows untrusted applications to access certain camera functions via deeplink, presenting a remote-like risk without user interacti...

AlmaLinux 8 : postgresql:10 (ALSA-2022:4805)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:4805 advisory. postgresql: Autovacuum, REINDEX, and others omit security restricted operation sandbox CVE-2022-1552 Tenable has extracted the preceding description block directly...

AlmaLinux 8 : postgresql:12 (ALSA-2022:4807)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:4807 advisory. postgresql: Autovacuum, REINDEX, and others omit security restricted operation sandbox CVE-2022-1552 Tenable has extracted the preceding description block directly...

Exploit for Improper Restriction of XML External Entity Reference in Rocketsoftware Ags-Zena

Zena Housekeeping notes: The original CookieMonster Repo can b...

Inconsistency in view functions can lead to users believing they’re due for more BKD rewards

Lines of code Vulnerability details Impact The view functions used for a user to check their claimable rewards vary in their implementation. This can cause users to believe they are due X amount but will receive Y. Proof of Concept If the inflationRecipient is set, then poolStakedIntegral will be...