818 matches found
The vulnerability of the `make_task` function in the software for managing medical organizations, OpenEMR, allows attackers to carry out SQL injection attacks.
The vulnerability of the maketask function in the software for managing medical organizations like OpenEMR is related to the lack of verification of the reliability of XML objects’ sequences. Exploiting this vulnerability allows a malicious actor to carry out attacks based on SQL injections...
Missing Authorization in DayByDay CRM
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account employee type user, can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of...
Daybyday CRM 授权问题漏洞
DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. DayByDay CRM Information Disclosure Vulnerability, the vulnerability stems from the product's failure to add an effective restriction o...
PT-2021-21327 · Emuse · Emuse
Name of the Vulnerable Software and Affected Versions: Emuse - eServices / eNvoice affected versions not specified Description: The issue concerns the exposure of private personal information due to a lack of identification mechanisms and predictable IDs. An attacker can exploit this to scrape al...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none...
The vulnerability of the debug_post_set.cgi component in the D-Link DWR-932C E1 router microprogramming system allows a hacker to increase their privileges.
The vulnerability of the debugpostset.cgi component in the D-Link DWR-932C E1 router microprogramming system is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending a specially crafted HTTP request...
MAZ Loader < 1.4.1 - Arbitrary Loader Deletion via CSRF
The plugin does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack The vendor has been notified on August 24th, 2021, as well as escalated to the WP plugins team 3 times, no fix was made despite two new versions being released. PoC...
CVE-2021-30315
Improper handling of sensor HAL structure in absence of sensor can lead to use after free in Snapdragon Auto...
WordPress Plugin Timetable and Event Schedule 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
PT-2021-9468 · Unknown · Magicmotion Flamingo 2
Name of the Vulnerable Software and Affected Versions: MagicMotion Flamingo 2 affected versions not specified Description: The issue concerns a lack of BLE encryption, which enables data sniffing and packet forgery. Recommendations: At the moment, there is no information about a newer version tha...
CVE-2021-23405
This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class...
The vulnerability of the RTAS kernel component in the Linux operating system relates to the absence of a mechanism for authentication. This lack allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the RTAS component of the Linux operating system is related to improper handling of memory access. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none...
Information disclosure
GENIVI Diagnostic Log and Trace DLT provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the applications which are using the configuration file could fail t...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...
The vulnerability of the scan.c component in the X11vnc server allows attackers to gain access to confidential data, compromise its integrity, and cause service failures. This vulnerability is related to the absence of a authentication mechanism.
The vulnerability of the scan.c component in the X11vnc server relies on the absence of an authentication mechanism. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...
Mozilla: Malicious extensions could have spoofed popup information
The Mozilla Foundation Security Advisory describes this issue as: A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website...
The vulnerability of the Active Directory Domain Controller (AD DC) in the Samba networking software package arises from a lack of privilege control mechanisms and access management tools. This vulnerability allows attackers to gain access to confidential data, compromise its integrity, and cause service interruptions.
The vulnerability of the Active Directory Domain Controller AD DC in the Samba networking software package is related to the lack of privilege control mechanisms and access management tools. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its...