853 matches found
Maharashtra State Electricity Distribution Maharashtra State Electricity Board Android Application 信息泄露漏洞
Maharashtra State Electricity Distribution Maharashtra State Electricity Board Android Application is an official consumer oriented application of Maharashtra State Electricity Distribution of India is an official consumer oriented application of Maharashtra State Electricity Distribution. A...
backstage cross-site scripting vulnerability
backstage is an application. Backstage is an open platform for building developer portals Backstage is vulnerable to a cross-site scripting vulnerability that stems from the lack of filtering and escaping of URL parameters in the affected version of the auth-backend plugin. An attacker could use...
backstage 跨站脚本漏洞
backstage is an application. Backstage is an open platform for building developer portals Backstage is vulnerable to a cross-site scripting vulnerability that stems from the lack of filtering and escaping of URL parameters in the affected version of the auth-backend plugin. An attacker could use...
Moodle Cross-Site Scripting Vulnerability (CNVD-2021-93379)
Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. cross-site scripting vulnerability exists in Moodle, which stems from the lack of effective filtering and escaping of URL parameters in...
Cross site scripting
In Factor App Framework & Headless CMS forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...
CVE-2021-42337
The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters...
Design/Logic Flaw
The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters...
CVE-2021-42337 TVN-202110009
The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters...
Cisco Webex Video Mesh Input Validation Error Vulnerability
Cisco Webex Video Mesh is a software from Cisco, U.S.A. Cisco Webex Video Mesh dynamically finds the best combination of local and cloud conferencing resources. When local resources are sufficient, local meetings stay local. When local resources are exhausted, the conference is expanded to the...
CVE-2021-1500
Cisco Webex Video Mesh suffers an input validation flaw in the web-based management interface that improperly validates URL parameters in HTTP requests. An unauthenticated, remote attacker could lure a user to click a crafted link and be redirected to a malicious site, enabling phishing scenarios...
Easytest licensing issue vulnerability
Easytest is an online learning quiz platform of China's Huaju Digital Technology, Inc. Easytest is vulnerable to authorization issues, which can be exploited by remote attackers to access user and administrator account information other than passwords by constructing URL parameters after gaining...
ShinHer StudyOnline System License Issue Vulnerability
ShinHer StudyOnline System is a school administration system from ShinHer, China. " feature is not controlled by permissions. An attacker could use this vulnerability to access other users' message board content by setting URL parameters after logging in with user privileges...
ShinHer StudyOnline System Licensing Issue Vulnerability (CNVD-2021-101182)
ShinHer StudyOnline System is a school system from ShinHer, China. ShinHer StudyOnline System is vulnerable to an authorization issue, which stems from the fact that the teacher editing function of ShinHer StudyOnline System is not controlled by permissions. An attacker could use this vulnerabili...
ShinHer StudyOnline System Licensing Issue Vulnerability (CNVD-2021-101183)
ShinHer StudyOnline System is a school system from ShinHer, a Chinese company. ShinHer StudyOnline System is vulnerable to an authorization issue that stems from the Study Edit feature of ShinHer StudyOnline System without permission control. An attacker could use this vulnerability to access and...
CVE-2021-42336
The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters...
CVE-2021-42331
The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters...
CVE-2021-42330
The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters...
CVE-2021-42332
The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the content of other users’ message boards by crafting URL parameters...
Design/Logic Flaw
The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the content of other users’ message boards by crafting URL parameters...
Design/Logic Flaw
The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters...