2843 matches found
YSoft SAFEQ 6 安全漏洞
YSoft SAFEQ 6 is an Enterprise Print Management Suite solution platform from YSoft Czech Republic. A security vulnerability exists in YSoft SAFEQ 6 versions prior to 6.0.72, which stems from incorrect permissions being configured as part of the installer package for the Client V3 service, and can...
PT-2022-24258 · Ysoft · Y Soft Safeq
Name of the Vulnerable Software and Affected Versions: YSoft SAFEQ versions prior to 6.0.72 Description: An issue in YSoft SAFEQ allows for local user privilege escalation. This is due to incorrect privileges configured as part of the installer package for the Client V3 services, enabling an...
CVE-2019-15167
The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrpprint for VRRP version 3, a different vulnerability than CVE-2018-14463...
CVE-2022-20823
A vulnerability in the OSPF version 3 OSPFv3 feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to incomplete input validation of specific OSPFv3 packets. An attacker could...
PT-2022-9905
Name of the Vulnerable Software and Affected Versions Python versions 3.x through 3.10 Description The issue is related to an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path, which may lead to information disclosure. It is...
CandidATS SQL注入漏洞
CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0 Beta that stems from allowing authenticated users to inject SQL queries via the userID parameter...
UPX 数字错误漏洞
UPX is a portable and extensible executable compression program. A security vulnerability exists in UPX version 3.96, which stems from a floating-point exception issue found in the PackLinuxElf64::invertptdynamic function of the plxelf.cpp file, which can be triggered by an attacker with a crafte...
CVE-2022-36308
Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate the eNodeB over SNMP. This issue may...
PT-2022-23303 · Airspan · Airspan Airvelocity 1500
Name of the Vulnerable Software and Affected Versions: Airspan AirVelocity 1500 versions prior to 15.18.00.2511 Description: The web management UI of the affected software displays SNMP credentials in plaintext and stores SNMPv3 credentials unhashed on the filesystem. This allows anyone with web...
PT-2022-22146 · Wms · Wms
Name of the Vulnerable Software and Affected Versions: WMS version 3.7 Description: The issue allows an attacker to potentially exploit a Path Traversal Vulnerability in the Device API, gaining unauthorized read access to files stored on the server filesystem with the privileges of the running we...
CVE-2022-35493
A Cross-site scripting XSS vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the getproducts?search parameter...
rsync 输入验证错误漏洞
rsync is an open source utility program by Wayne Davison, an individual developer, that provides fast incremental file transfers. A security vulnerability exists in versions prior to rsync 3.2.5 that stems from insufficient validation of filenames by the rsync client...
CVE-2022-35118
PyroCMS v3.9 was discovered to contain multiple cross-site scripting XSS vulnerabilities...
PyroCMS 跨站脚本漏洞
PyroCMS is a lightweight open source content management system developed by an individual developer using the CodeIgniter framework. A cross-site scripting vulnerability exists in PyroCMS v3.9, which stems from being found to contain multiple cross-site scripting XSS vulnerabilities...
EllieGrid Android Application 代码注入漏洞
EllieGrid Android Application is a smart pill manager from US-based EllieGrid. A security vulnerability exists in EllieGrid Android Application version 3.4.1 that stems from vulnerability to code injection attacks...
"Hulu" App for Android uses a hard-coded API key for an external service
Overview "Hulu" App for Android provided by HJ Holdings, Inc. uses a hard-coded API key for an external service CWE-798. Ryo Sato of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact T...
CVE-2022-36412
In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. An API request may, in effect, be executed with the credentials of a user who authenticated in the past...
CVE-2022-30706
Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL...
Booked vulnerable to open redirect
Overview Booked provided by Twinkle Toes Software contains an open redirect vulnerability CWE-601. Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact When...