br.tag 跨站脚本漏洞

br.tag is an open source software from Research Institute for Innovation and Technology that supports social technology-based school management. A security vulnerability exists in versions prior to br.tag 2.13.0 that stems from the presence of unknown functionality that manipulates to cause...

Command Execution Vulnerability in UFIDA GRP-U8 (CNVD-2023-02755)

UFIDA GRP-U8 is a new generation product launched by UFIDA focusing on the national e-government business and based on cloud computing technology, which is the government financial management software in the field of finance for administrative undertakings in China. A command execution...

The vulnerability in the web interface of Cisco Firepower Management Center’s software for network management allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the web interface for managing Cisco Firepower Management Center FMC software involves a lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Opencast 输入验证错误漏洞

Opencast is a live video support software for large-scale automated video capture, management and distribution from the Opencast organization. An input validation error vulnerability exists in versions of Opencast prior to 12.5. An attacker could exploit this vulnerability to redirect users to a...

CVE-2022-39371

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Script related HTML tags in assets inventory information are not properly neutralized. This issue has...

Code injection

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Administrator may store malicious code in entity name. This issue has been patched, please upgrade to...

CVE-2022-39323

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST usertoken. This issue has been patched, please...

CVE-2022-39372

GLPI, CVE-2022-39372, affects GLPI before 10.0.13 (updates also mention 10.0.15 as a fix level). Connected sources document multiple vulnerabilities in GLPI’s components across versions prior to 10.0.13/10.0.15, including: SQL injection in search/map/search-related features, SSRF, and cross‑site ...

CVE-2022-39372 Stored Cross-Site Scripting (XSS) in user information in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account information. This issue has been patche...

CVE-2022-39234

GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2022-39234: a deleted or deactivated user may continue to use their account while a valid session cookie exists. The remediation is to upgrade to GLPI 10.0.4 or later; no workaround is documented in the provided sources.

CVE-2022-39372 Stored Cross-Site Scripting (XSS) in user information in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account information. This issue has been patche...

CVE-2022-39277 Cross-Site Scripting (XSS) in external links in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting XSS...

CVE-2022-39276

GLPI (Gestionnaire Libre de Parc Informatique) contains a SSRF-type issue in the planning features (RSS feeds or external calendar). If a remote script returns a redirect, the target URL isn’t checked against the administrator’s allow-list, enabling potential redirection-based access. This CVE (C...

CVE-2022-39373

CVE-2022-39373 affects GLPI where an administrator can store malicious code in an entity name; the issue has been patched and users should upgrade to GLPI 10.0.4 to remediate.

CVE-2022-39323 SQL Injection on REST API in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST usertoken. This issue has been patched, please...

CVE-2022-39375

CVE-2022-39375 affects GLPI (Gestionnaire Libre de Parc Informatique). The vulnerability allows a user to create a public RSS feed that can inject malicious code into dashboards viewed by other users. The issue has been patched; upgrade to GLPI version 10.0.4 or later. The initial description sta...

CVE-2022-39277 Cross-Site Scripting (XSS) in external links in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting XSS...

PT-2022-10668 · Unknown · Employee Record Management System

Name of the Vulnerable Software and Affected Versions: Employee Record Management System version 1.2 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the editempprofile.php endpoint. Recommendations: For Employee Record Management System version 1....

Siemens Siveillance Video Mobile Server Authentication Bypass Vulnerability

Siveillance Video formerly known as SiveillanceVMS is a utility IP video management software for deployments ranging from small and simple to large and highly secure. An authentication bypass vulnerability exists in Siemens Siveillance Video Mobile Server due to the mobile server component of the...

SAP Data Services Management Cross-Site Scripting Vulnerability

SAP Data Services Management is a data services management software from SAP, Germany. It helps ensure that multiple, potentially inconsistent versions of data are not used in different parts of the business, including processes, operations, analytics, and reporting. A cross-site scripting...