3490 matches found
MotionEye allows attackers to access sensitive information
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...
PYSEC-2022-43141
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...
Design/Logic Flaw
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...
PYSEC-2022-43141
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...
CVE-2022-25568
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...
MotionEye-Project MotionEye 信息泄露漏洞
MotionEye-Project MotionEye is a web-based motion front-end from the individual developer Calin Crisan. A security vulnerability exists in MotionEye-Project MotionEye v0.42.1 and prior versions, which stems from the application's lack of permissions restriction and filtering for GET requests to...
CVE-2022-25216
An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player recently renamed PlayerFab has read-access, by means of an HTTP GET request to http://:32080/download/...
CVE-2022-25216
DVDFab 12 Player/PlayerFab is affected by a local file inclusion (absolute path traversal) via HTTP GET to /download/. The issue allows remote attackers to download any file on the Windows filesystem readable by the running user. Root cause: traversal of local paths in the download endpoint. Affe...
CVE-2021-45310
Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted b...
Information disclosure
Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted b...
Fortinet FortiMail Cross-Site Scripting Vulnerability (CNVD-2022-19073)
Fortinet FortiMail is a suite of email security gateway products from Fortinet, Inc. Fortinet FortiMail is vulnerable to a cross-site scripting vulnerability that could be exploited to execute unauthorized code or commands via a specially crafted HTTP GET request to the FortiGuard URI protection...
FortiMail 跨站脚本漏洞
Fortinet FortiMail is a suite of email security gateway products from Fortinet, Inc. Fortinet FortiMail is vulnerable to a cross-site scripting vulnerability that could be exploited to execute unauthorized code or commands via a specially crafted HTTP GET request to the FortiGuard URI protection...
WordPress Cookie Notification Plugin Plugin SQL Injection Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. A SQL injection vulnerability exists in previous versions of the Wordpress Plugin Cookie Notification Plugin 1.0.9, which stems from the product's failure to validate special characters in the id...
Unspecified vulnerability in DELL EMC AppSync (CNVD-2022-06705)
DELL EMC AppSync is a replication data management software from Dell USA Inc. A security vulnerability exists in DELL EMC AppSync due to the use of the GET request method with sensitive query strings in DELL EMC AppSync versions 3.9 through 4.3. . An attacker could use this vulnerability to hijac...
WordPress plugin SQL注入漏洞
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. A SQL injection vulnerability exists in previous versions of the Wordpress Plugin Cookie Notification Plugin 1.0.9, which stems from the product's failure to validate special characters in the id...
CVE-2022-22551
DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session...
CVE-2022-22551
DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session...
CVE-2021-33966
Cross site scripting XSS vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page...