EUVD-2024-50625

Malicious code in bioql PyPI...

EUVD-2022-29674

Malicious code in bioql PyPI...

EUVD-2022-29672

Malicious code in bioql PyPI...

CVE-2024-5890

ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website. ServiceNow released updates to customers that addressed this...

CVE-2022-29950

Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the 1 rule name parameter to the Rules page or the 2 subrule name or 3 categories name parameter to the Subrules page. NOTE: the vendor disputes this because version 1.16 has never existed...

CVE-2024-12142

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modification of web page and denial of service when specific web pages are modified and restricted functions are invoked...

CVE-2024-12142

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modification of web page and denial of service when specific web pages are modified and restricted functions are invoked...

CVE-2024-12142

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modification of web page and denial of service when specific web pages are modified and restricted functions are invoked...

CVE-2024-12142

Schneider Electric Modicon M340, BMXNOE0100/0110 and BMXNOR0200H are affected by CVE-2024-12142 (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability allows information disclosure for restricted web pages, modification of web pages, and denial of service when sp...

Schneider Electric Modicon M340 信息泄露漏洞

The Schneider Electric Modicon M340 is a mid-range PLC programmable logic controller for industrial processes and infrastructure from Schneider Electric France. An information disclosure vulnerability exists in the Schneider Electric Modicon M340, which stems from the inclusion of an Exposure of...

PT-2024-10144 · Schneider Electric · Bmxnoe0100 +3

The issue at hand is related to a sensitive information exposure flaw, which could lead to the disclosure of restricted web pages, modification of web pages, and denial of service when specific web pages are modified and restricted functions are invoked. This flaw is identified by the CWE-200...

CVE-2024-5890

Technical details beyond the description are not provided in the connected documents. Monitor for updates from ServiceNow and vendors; apply patches when available.

PT-2024-37225 · Servicenow · Servicenow

Name of the Vulnerable Software and Affected Versions: ServiceNow affected versions not specified Description: The issue is related to an HTML injection vulnerability identified in the Now Platform. This could potentially enable an unauthenticated user to modify a web page or redirect users to...

ServiceNow Now Platform 安全漏洞

ServiceNow Now Platform is a cloud-based platform from US-based ServiceNow that uses AI and machine learning to automate and optimize work across the enterprise. A security vulnerability exists in ServiceNow Now Platform that stems from the presence of an HTML injection vulnerability that could...

MegaBIP SQL Injection Vulnerability

MegaBIP is a software for creating BIP websites. A security vulnerability exists in MegaBIP version 5.12.1 and prior versions. An attacker could exploit the vulnerability to disclose database content, obtain a session cookie, or modify page content...

Broken Access Control

TYPO3 is vulnerable to Broken Access Control. The vulnerability is due to backend users with limited access to specific languages being able to modify and create pages in the default language, which should be disallowed. A valid backend user account is required to exploit this vulnerability...

SUSE CVE-2022-24919

An authenticated user can create a link with reflected Javascript code inside it for graphs' page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all t...

OpenCMS Cross-Site Scripting vulnerability

Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user: with sufficient privileges to create and modify web pages through the admin panel, can execute malicious JavaScript code, after inserting code in the title field...

CVE-2023-20179

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could...

ROS-20230911-07

A vulnerability in the Moodle virtual learning environment is related to insufficient validation of user input data. data, an attacker could send a specially crafted HTTP request and make the application initiate requests to arbitrary systems. Exploitation of the vulnerability could allow an...