9928 matches found
Improper access control
An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests...
CVE-2022-23443
FortiSOAR flaw (CVE-2022-23443) : Fortinet FortiSOAR before 7.2.0 has improper access control (CWE-284) that allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests. Exploitation occurs over the network with no auth. Advisories from FortiGuard (FG-IR-22-041) and ...
ClamAV 安全漏洞
Clam AntiVirus is an open source antivirus engine for detecting Trojans, viruses, malware and other malicious threats.Clam AntiVirus suffers from a memory leak vulnerability that can be exploited by unauthenticated remote attackers to cause a denial of service...
ClamAV 资源管理错误漏洞
Clam AntiVirus is an open source antivirus engine for detecting Trojans, viruses, malware and other malicious threats.Clam AntiVirus suffers from a resource management error vulnerability that stems from an infinite loop in the TIFF file parser and can be exploited by unauthenticated remote...
CVE-2022-0952
The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as...
Cross site request forgery (csrf)
The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as...
CVE-2022-0952 Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update
The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as...
CVE-2021-25086 Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting
The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it...
PT-2022-9642 · WordPress · Advanced Page Visit Counter
Name of the Vulnerable Software and Affected Versions: Advanced Page Visit Counter WordPress plugin versions prior to 6.1.2 Description: The issue allows unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing the admin dashboard page, due to the plugin not...
CVE-2022-27926
A reflected cross-site scripting XSS vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration aka ZCS 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters...
Cross site scripting
A reflected cross-site scripting XSS vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration aka ZCS 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters...
CVE-2022-27926
A reflected cross-site scripting XSS vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration aka ZCS 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker...
CVE-2022-27926
A reflected cross-site scripting XSS vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration aka ZCS 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters...
CVE-2022-27926
A reflected cross-site scripting XSS vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration aka ZCS 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters...
CVE-2022-27926
A reflected cross-site scripting XSS vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration aka ZCS 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters...
Unspecified Vulnerability in Oracle Fusion Middleware and Oracle Business Intelligence Enterprise Edition (CNVD-2022-33106)
Oracle Fusion Middleware and Oracle Business Intelligence Enterprise Edition are both products of Oracle Corporation.Oracle Fusion Middleware is a suite of business innovation platforms for enterprise and cloud environments. Oracle Fusion Middleware is a business innovation platform for enterpris...
Design/Logic Flaw
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the /includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in...
Cross site scripting
The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the /inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21...
CVE-2022-1187 WP YouTube Live <= 1.7.21 - Reflected Cross-Site Scripting
The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the /inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21...
CVE-2022-1119
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the /includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in...