4889 matches found
Devolutions Remote Desktop Manager security vulnerabilities
Devolutions Remote Desktop Manager is an application from Devolutions Canada. It provides remote desktop management functionality. A security vulnerability exists in Devolutions Remote Desktop Manager versions prior to 2022.1.8 that stems from an information disclosure vulnerability in My Account...
WordPress plugin Brizy has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in versions of the WordPress Brizy plugin prior to 2.4.2, whi...
CVE-2022-34295
totd before 1.5.3 does not properly randomize mesg IDs...
CVE-2022-31478
The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function...
CVE-2022-2128
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4...
CVE-2022-1472
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection...
McAfee Consumer Product Removal Tool code-related vulnerabilities
McAfee Consumer Product Removal Tool is a McAfee, Inc. designed to completely remove McAfee Security products in order to reinstall or install different antivirus software. A code issue vulnerability exists in versions prior to McAfee Consumer Product Removal Tool 10.4.128, which stems from an...
GLPI Inventory Plugin Path Traversal Vulnerability
GLPI Inventory Plugin is a French GLPI open source plugin . It is used to handle various types of tasks for GLPI agents. A path traversal vulnerability exists in versions prior to GLPI Inventory Plugin 1.0.2, which stems from a public script that can be used to read the contents of system files...
PT-2022-14454 · Unknown · Polonel/Trudesk
Name of the Vulnerable Software and Affected Versions: polonel/trudesk versions prior to 1.2.4 Description: The issue concerns the incorrect use of privileged APIs in the GitHub repository polonel/trudesk. Recommendations: For versions prior to 1.2.4, update to version 1.2.4 or later to resolve t...
AZL-9934 CVE-2022-2129 affecting package vim for versions less than 8.2.5172-1
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2...
InvenTree security vulnerabilities
InvenTree is an open source inventory management system from InvenTree Open Source. Provides powerful low-level inventory control and parts tracking . A CSV injection vulnerability exists in InvenTree versions prior to 0.7.2, which stems from an application that does not filter the escaping of...
CVE-2022-32154
Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and...
CVE-2022-32155
In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the...
CVE-2022-32260
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. The affected application creates temporary user credentials for UMC User Management Component users. An attacker could use these temporary credentials for authentication bypass in certain scenarios...
CVE-2022-30229
A vulnerability has been identified in SICAM GridEdge Classic All versions V2.6.6. The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to change data of a user, such as credentials, in case that user's id is known...
PT-2022-2949 · Spacelogic +1 · Spacelogic C-Bus Application Controller +3
Name of the Vulnerable Software and Affected Versions: C-Bus Network Automation Controller - LSS5500NAC versions prior to V1.10.0 Wiser for C-Bus Automation Controller - LSS5500SHAC versions prior to V1.10.0 Clipsal C-Bus Network Automation Controller - 5500NAC versions prior to V1.10.0 Clipsal...
PT-2022-3520 · Unknown · Data Center Expert
Name of the Vulnerable Software and Affected Versions: Data Center Expert versions prior to 7.9.0 Description: The issue is related to insufficient protection of registration data, which could allow a remote attacker to gain full control over the software. This could result in unwanted access to ...
CVE-2022-1800
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability...
CVE-2022-1532
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...