SourceCodester Online Covid Vaccination Scheduler System跨站脚本漏洞（CNVD-2022-13077）

SourceCodester Online Covid Vaccination Scheduler System is an application of SourceCodester, Inc. Sourcecodester Online Covid Vaccine Scheduler System is a cross-site scripting vulnerability that stems from the lack of escaping or filtering of user data in the software lid parameter, which could...

Moodle SQL Injection Vulnerability (CNVD-2022-09258)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle 3.11 through 3.11.4 suffers from a SQL injection vulnerability that stems from insufficient cleaning of user-supplied data in th...

CVE-2022-0332

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data...

CVE-2022-22296

Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manageuser endpoint. Simply change the value and data of other users can be displayed...

Improper Authentication in liukuo362573/yishaadmin

Description Hi, I would like to report an improper authentication vulnerability in https://www.github.com/liukuo362573/yishaadmin. Endpoint "/admin/OrganizationManage/User/ExportUserJson" does not require any authentication and return xls file contain users data like username, fullname, email,...

Moodle SQL注入漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle 3.11 through 3.11.4 suffers from a SQL injection vulnerability that stems from insufficient cleaning of user-supplied data in th...

Navidrome SQL注入漏洞

Navidrome is a web-based open source music collection server and streamer. Used to freely listen to music collections from any browser or mobile device, a SQL injection vulnerability exists in versions of Navidrome prior to 0.47.5, which stems from a lack of validation of externally entered SQL...

Improper Authentication in liukuo362573/yishaadmin

Description Hi there yishaadmin maintainer, I would like to report an improper authentication vulnerability in yishaadmin source code. The link /admin/OrganizationManage/User/GetFormJson?id=user-id does not require any authentication and return sensitive user data for anyone like username, gender...

The vulnerability in the isolated iframe of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, relates to improper handling of user data. This allows an attacker to perform a spoofing attack.

The vulnerability of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, is related to the improper handling of user data. Exploiting this vulnerability allows a malicious actor to perform a spoofing attack when executing a program and processing an external URL request...

CVE-2022-0236

The WP Import Export WordPress plugin both free and premium versions is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for...

Design/Logic Flaw

The WP Import Export WordPress plugin both free and premium versions is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for...

CVE-2022-0236 WP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data Disclosure

The WP Import Export WordPress plugin both free and premium versions is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for...

WordPress 安全漏洞

WordPress plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress plugin Import Export plugin that stems from a missing function check in the download function wpieprocessfiledownload in the /includes/classes/class-wpie-general.php file. An...

FlashGet Buffer Overflow (CVE-2020-28967)

A buffer overflow vulnerability exists in the FlashGet download manager. The vulnerability is due to lack of proper validation of user data in 'current path directory' function...

ROS-20220114-02

Vulnerability in Mozilla Thunderbird email client, related to memory usage after memory freeing due to a race condition when playing audio files. Exploitation of the vulnerability could allow an attacker acting remotely to create a specially crafted audio shell, trigger a post-release usage error...

HPESBGN04232 rev.1 - HPE Network Functions, Apache Log4j 2 Remote Arbitrary Code Execution

Potential Security Impact: Remote: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified Data Management UDM 1.2009.0, 1.2101.0, 1.2103.0, 1.2105.0, 1.2107.0, 1.2109.0, 1.2109.1 HPE Authentication Server Function AUSF 1.2009.0, 1.2101.0, 1.2103.0,...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TVS file...

Red Hat Keycloak 跨站脚本漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A cross-site scripting vulnerability exists in Redhat Keycloak, which stems from a lack of filtering and transfer of user-submitted data in...

Online Diagnostic Lab Management System 1.0 - Stored Cross Site Scripting Vulnerability

Exploit Title: Online Diagnostic Lab Management System 1.0 - Stored Cross Site Scripting XSS Exploit Author: Himash Vendor Homepage: https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html Software Link:...

The Facebook Pixel Hunt aims to unravel Facebook’s tracking methods. Will you join?

Browser developer Mozilla has announced a research project to provide insights into, and data about, a space that’s opaque to policymakers, researchers and users themselves. Tracking the trackers is the name of the game. Give up some of your data voluntarily to stop the involuntary collection by...