Sql injection

Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform an attack to extract potentially sensitive information from the database if the survey id exists...

CVE-2022-44790

CVE-2022-44790 concerns Interspire Email Marketer (up to version 6.5.1) where the vulnerability is a SQL Injection in the surveys module . An unauthenticated attacker could extract potentially sensitive data from the database if the survey ID exists. The root cause is improper input handling lead...

PT-2022-27313 · Interspire · Interspire Email Marketer

Name of the Vulnerable Software and Affected Versions: Interspire Email Marketer versions 6.5.1 and earlier Description: The issue allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform an attack to extract potentially sensitive information from the...

CVE-2022-44790

Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform an attack to extract potentially sensitive information from the database if the survey id exists...

CVE-2022-44790

Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform an attack to extract potentially sensitive information from the database if the survey id exists...

PT-2022-6730 · Cisco · Cisco Webex Meetings

Name of the Vulnerable Software and Affected Versions: Cisco Webex Meetings affected versions not specified Description: The issue is related to insufficient validation of user-supplied input in Webex Events classic programs, email templates, and survey questions, allowing an authenticated, remot...

CVE-2022-40777

Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550...

CVE-2022-40777

Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550...

Design/Logic Flaw

Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550...

BigCommerec Interspire Email Marketer 代码问题漏洞

Bigcommerec BigCommerec Interspire Email Marketer IEM is a suite of email marketing software from the US-based company Bigcommerec. A security vulnerability exists in Interspire Email Marketer version 6.5.0 that originates from allowing arbitrary files to be uploaded via the surveyssubmit.php...

PT-2022-25535 · Interspire · Interspire Email Marketer

Name of the Vulnerable Software and Affected Versions: Interspire Email Marketer versions prior to 6.5.1 Description: The issue allows for arbitrary file upload through a "create survey and submit survey" operation in surveys submit.php. This can lead to a .php file being accessible under the...

WordPress "WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto" plugin < 5.3.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto" plugin versions 5.3.2. Solution Update the WordPress "WordPress form builder plugin for contact forms, surveys and...

CVE-2021-24763

The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the saveglobalsetting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stor...

CVE-2021-24763

CVE-2021-24763 affects the WordPress Perfect Survey plugin prior to 1.5.2. The issue is an unauthorised AJAX path (save_global_setting) lacking proper authorisation/CSRF checks, allowing unauthenticated users to edit surveys and settings. Due to insufficient sanitisation/escaping, this can enable...

Webform - Critical - Cross Site Scripting, Access Bypass - SA-CONTRIB-2021-045

Access Bypass: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently check access for administrative features for webforms attached to nodes using the Webform Node module. This may reveal submitted data or allow an attacker to modify submitted data...

CVE-2021-24801

The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site...

Cross site scripting

The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site...

CVE-2021-24801 WP Survey Plus <= 1.0 - Subscriber+ AJAX Calls

The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site...

Attack AI systems in Machine Learning Evasion Competition

Today, we are launching MLSEC.IO, an educational Machine Learning Security Evasion Competition MLSEC for the AI and security communities to exercise their muscle to attack critical AI systems in a realistic setting. Hosted and sponsored by Microsoft, alongside NVIDIA, CUJO AI, VM-Ray, and MRG...

Working from home: Options and opportunities

By Owais Sultan Technology has given ample opportunities to work from home even when the entire world is suffering from the COVID-19 pandemic. Here are some of the ways through which you can take advantage of technology and cybersecurity to work online from home. Bug bounty hunter Become Copywrit...