16712 matches found
CVE-2022-20925
Summary (CVE-2022-20925) : The Cisco Firepower Management Center (FMC) web management interface is affected by an API input validation vulnerability. An authenticated attacker with Device-permission credentials could exploit crafted input to API endpoints to execute arbitrary OS commands with low...
CVE-2022-35740
dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...
CVE-2020-12931
Improper parameters handling in the AMD Secure Processor ASP kernel may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity...
CVE-2020-12930
Improper parameters handling in AMD Secure Processor ASP drivers may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity...
Input validation
Improper parameters handling in the AMD Secure Processor ASP kernel may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity...
CVE-2020-12931
Improper parameters handling in the AMD Secure Processor ASP kernel may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity...
CVE-2022-41203
In some workflow of SAP BusinessObjects BI Platform Central Management Console and BI LaunchPad, an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted...
kernel: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGIRJT There is a potential memory leak in lpfcignoreelscmpl and lpfcelsrspreject that was allocated from NPIV PLOGIRJT lpfcrcvplogi's loginmbox. Check if...
kernel: race condition in snd_pcm_hw_free leading to use-after-free
A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hwparams. The hwfree ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges ...
There is an RCE vulnerability
Description - There is an RCE vulnerability in qmpaas/leadshop https://github.com/qmpaas/leadshop v1.4.15. An attacker can access the file leadshop.php and call any existing function through GET to control the target host. The vulnerability is in the leadshop/web/leadshop.php27-61 file public...
GHSA-M7GV-V8XX-V47W XWiki OIDC Authenticator vulnerable to bypassing OpenID login by providing a custom provider
Impact Even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider by providing its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the...
XWiki OIDC Authenticator vulnerable to bypassing OpenID login by providing a custom provider
Impact Even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider by providing its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the...
Online Diagnostic Lab Management System SQL Injection Vulnerability
Online Diagnostic Lab Management System is an online diagnostic lab management system that provides a variety of diagnostic tasks online. online Diagnostic Lab Management System is vulnerable to SQL injection in version v1.0. The vulnerability stems from the affected version not properly filterin...
CVE-2022-44624
In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters...
CVE-2022-42744
CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks...
CVE-2022-44624
CVE-2022-44624 affects JetBrains TeamCity versions prior to 2022.10, where password parameters containing special characters could be exposed in build logs. The issue stems from password parameter handling in the affected build process. Impact is information disclosure in logs; no exploitation de...
CVE-2022-44624
In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters...
CVE-2022-44624: Insertion of Sensitive Information into Log File
In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters...
Reflected XSS on multiple locations and parameters
Description The user input is not being sanitized properly on multiple locations and on different parameters leading to XSS. Proof of Concept https://demo.bumsys.org/reports/sales-report/?salesDate=" Payload "...
Schoolbox SQL注入漏洞
Schoolbox is an online learning platform from Schoolbox Australia. A security vulnerability exists in Schoolbox version 21.0.2 that stems from multiple SQL injection attacks via vulnerable parameters. An attacker exploiting the vulnerability could extract data from the database...