Sql injection

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter...

CVE-2022-38197

CVE-2022-38197 affects Esri ArcGIS Server versions 10.9.1 and below, with an unvalidated redirect that could allow a remote, unauthenticated attacker to phish users to an attacker‑controlled site via a crafted query parameter. The issue stems from an unauthenticated redirection vulnerability; pre...

CVE-2022-38197 BUG-000148347 Unvalidated redirect issues in ArcGIS Server.

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter...

CVE-2022-38197 BUG-000148347 Unvalidated redirect issues in ArcGIS Server.

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter...

PT-2022-24249 · F Secure · F-Secure Policy Manager

Name of the Vulnerable Software and Affected Versions: WithSecure versions prior to 2022-08-10 Description: The issue is related to reflected cross-site scripting XSS vulnerabilities due to an unvalidated parameter in an endpoint, allowing remote attackers to provide malicious input. This affects...

PT-2022-24274 · Esri · Esri Arcgis Server

Name of the Vulnerable Software and Affected Versions: Esri ArcGIS Server versions 10.9.1 and below Description: The issue is related to an unvalidated redirect that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker-controlled website via a crafted query...

WithSecure products 跨站脚本漏洞

WithSecure products is a series of security software from the Finnish company WithSecure. A security vulnerability exists in WithSecure versions 2022-08-10 and earlier, which stems from the presence of reflected cross-site scripting with unvalidated parameters in an endpoint, allowing a remote...

The vulnerability of the PPP over Ethernet (PPPoE) network gateway function in Cisco IOS XR operating systems allows a hacker to trigger a service failure.

The vulnerability of the PPP over Ethernet PPPoE network gateway function in Cisco IOS XR operating systems is related to an unvalidated error state. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending specific PPPoE packets...

Tenda AC18 缓冲区错误漏洞

Tenda AC18 is a router from Tenda, a Chinese company. tenda AC18 is vulnerable to a stack overflow vulnerability, which stems from a lack of length validation of the time parameter of the fromSetSysTime function for input data. An attacker could exploit the vulnerability to cause a denial of...

FluentForm < 4.3.13 - CSV Injection

The plugin does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection PoC - As unauthenticated, submit a form using =5+5 as value in any field - As admin, export the data as CSV /wp-admin/admin.php?page=fluentformsid=1=entries - open the CSV with a...

Tenda AC1206 缓冲区错误漏洞

The AC1206 is a high performance router designed with Gigabit ports for both WAN and LAN ports. A buffer overflow vulnerability exists in the Tenda AC1206 firmware version USAC1206V1.0RTLV15.03.06.23multiTD01, which originates from the /bin/httpd file /goform/openSchedWifi in the function scheden...

CVE-2022-40178

A vulnerability has been identified in Desigo PXM30-1 All versions V02.20.126.11-41, Desigo PXM30.E All versions V02.20.126.11-41, Desigo PXM40-1 All versions V02.20.126.11-41, Desigo PXM40.E All versions V02.20.126.11-41, Desigo PXM50-1 All versions V02.20.126.11-41, Desigo PXM50.E All versions...

CVE-2022-3137

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user such as subscriber creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file...

Cross site scripting

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user such as subscriber creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file...

PT-2022-26427 · Centreon · Centreon

Name of the Vulnerable Software and Affected Versions: Centreon affected versions not specified Description: This issue allows remote attackers to escalate privileges on affected installations. Authentication is required to exploit this issue. The specific flaw exists within the handling of...

PT-2022-26416 · Unknown · Pdf-Xchange Editor

Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations. It requires user interaction, such as visiting a malicious page or opening a...

Remote Code Execution (RCE)

Joplin is vulnerable to remote code execution. The vulnerability is due to the application not validating the schema or protocol of existing links. An attacker can upload a malicious markdown file with links, which will be opened by shell.openExternal when a user opens the markdown file, resultin...

The vulnerability of SSH clients and server-side networking frameworks like Twisted involves buffer copying without input data validation, allowing attackers to cause service failures.

The vulnerability of SSH clients and server-side networking frameworks like Twisted relates to the ability to accept an infinite number of data entries for the SSH version identifier. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

SourceCodester Food Ordering Management System 安全漏洞

Food Ordering Management System is a food ordering management system from Carlo Montero's personal developer. The Food Ordering Management System is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements by username, and can be exploited by attackers...

EyesOfNetwork SQL注入漏洞

EyesOfNetwork EON is an open source, free IT monitoring solution from the EyesOfNetwork community. The solution provides features such as a business process configuration tool, generating pop-up windows when events occur in the active queue, and more. EyesOfNetwork EON 5.3.11 and prior versions...