CVE-2022-20811

Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the...

The vulnerability of the multimedia viewing function of Cisco Webex Meetings Server and Cisco Webex Meetings allows attackers to circumvent existing security restrictions.

The vulnerability of the multimedia viewing function in Cisco Webex Meetings Server and Cisco Webex Meetings relates to a flaw in the data protection mechanism. Exploiting this vulnerability allows an attacker to circumvent existing security restrictions remotely...

CVE-2022-39800

SAP BusinessObjects BI LaunchPad - versions 420, 430, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the network. On successful exploitation, an attacker can view or modify information causing a limited...

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform lies in the lack of security measures for the website structure, allowing attackers to view, add, modify, or delete data.

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to remotely view, add, modify, or delete data...

The vulnerability of the SAP Enterprise Portal software integration platform lies in its lack of protection for website structures, allowing attackers to view, add, modify, or delete data.

The vulnerability of the SAP Enterprise Portal software integration platform is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to remotely view, add, modify, or delete data...

Code injection

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify...

CVE-2022-3255 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify...

Rapid7 InsightVM 代码问题漏洞

Rapid7 InsightVM is a vulnerability scanning and management application from Rapid7 USA. A security vulnerability exists in Rapid7 InsightVM that stems from the presence of an information disclosure issue that allows an attacker to use the Inspect Element browser feature to delete the login panel...

CVE-2022-2753

The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made...

CVE-2022-2753 Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Stored XSS

The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made...

PT-2022-26582 · Apple · Macos Monterey +5

Name of the Vulnerable Software and Affected Versions: macOS Big Sur versions prior to 11.7 macOS Monterey versions prior to 12.6 macOS Ventura version 13 is not affected, versions prior to 13 are not specified iOS versions prior to 15.7 and 16 iPadOS versions prior to 15.7 Description: A logic...

Apple macOS Big Sur 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS Big Sur versions prior to 11.7, which stems from the fact that users may be able to view sensitive user information...

PT-2022-17101 · WordPress · Simple Banner

Name of the Vulnerable Software and Affected Versions: Simple Banner plugin for WordPress versions up to and including 2.11.0 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers to inject arbitrary web scripts via the pro versio...

Visual Composer Website Builder < 45.0.1 - Authenticated Stored XSS via Text Block

The plugin does not sanitise and escape its Text Block fields, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks PoC Create a post using the plugin editor, add a Text Block and put the following payload in its content: The XSS will be triggered whe...

Design/Logic Flaw

Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application...

CVE-2022-22326

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...

Authorization

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...

CVE-2022-22326

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...

CVE-2022-22326: Incorrect Authorization

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...

CVE-2022-22326

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...