3582 matches found
CVE-2022-3913 Rapid7 Nexpose Certificate Validation Issue
Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could allow an attacker in a privileged position on the network to provide their own HTTPS endpoint, or intercept communications to the...
PT-2023-1424 · Adobe · Framemaker
Name of the Vulnerable Software and Affected Versions: Adobe FrameMaker versions 2020 Update 4 and earlier, 2022 and earlier Description: The issue is related to improper input validation, which could result in arbitrary code execution in the context of the current user. Exploitation requires use...
PT-2023-34890 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.229 Description: A potential security issue exists due to a warning during failed attribute validation in the act mpls component of the Linux Kernel's net/sched module. The actual impact and attack...
PT-2023-13680 · Changingtec · Changingtech Megaservisignadapter
Name of the Vulnerable Software and Affected Versions: ChangingTech MegaServiSignAdapter affected versions not specified Description: The issue is related to improper input validation in the ChangingTech MegaServiSignAdapter component. An unauthenticated remote attacker can exploit this to access...
The vulnerability of the Elastic Search component in the Oracle PeopleSoft Enterprise PeopleTools business application suite allows a perpetrator to gain unauthorized access to protected data or to modify, add, or delete protected data.
The vulnerability of the Elastic Search component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected data or to modify, add, or...
GS Filterable Portfolio < 1.6.1 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC Note: First, you need to add a Portfoli...
CVE-2022-42405
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...
Download Video Sidebar Widgets <= 6.1 - Contributor+ Stored XSS via Shortcode
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC vsw source="youtube" id="3PdILZ1P74"...
CVE-2022-45770
Improper input validation in adgnetworkwfpdrv.sys in Adguard For Windows x86 through 7.11 allows local privilege escalation...
CVE-2023-0284 Improper validation of LDAP user IDs
Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk = 2.1.0p19, Checkmk = 2.0.0p32, and all versions of Checkmk 1.6.0 EOL are affected...
CVE-2023-24455
Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configure permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...
CVE-2022-34436
Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerability to bypass the firmware lock-down configuration and perform a firmware update...
CVE-2022-47911 CVE-2022-47911
Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system...
CVE-2022-4235
RushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. This is possible because the application exposes an activity and does not properly validate the data it receives...
PT-2023-1243 · Oracle · Oracle Hospitality Reporting/Analytics
Name of the Vulnerable Software and Affected Versions: Oracle Hospitality Reporting and Analytics version 9.1.0 Description: The issue is related to insufficient input validation in the Reporting component of Oracle Hospitality Reporting and Analytics. This easily exploitable vulnerability can be...
PT-2023-33253 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.82 Description: A potential security issue exists due to the re-fetching of the skb cb after tipc msg validate. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linu...
PT-2023-1202 · Oracle · Peoplesoft Enterprise Peopletools
Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise PeopleTools versions 8.59 through 8.60 Description: The issue is related to insufficient input validation in the Elastic Search component of the PeopleSoft Enterprise PeopleTools product. This can allow a remote attacker...
PT-2023-1242 · Oracle · Oracle Collaborative Planning +1
Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Installation component of Oracle Collaborative Planning, part of the Oracle E-Business Suite. This can allow a...
CVE-2022-46372 Alotcer - AR7088H-A Authenticated Command execution
Alotcer - AR7088H-A firmware version 16.10.3 Command execution Improper validation of unspecified input field may allow Authenticated command execution...