14322 matches found
Information Disclosure
grafana is vulnerable to information disclosure. The vulnerability exists in multiple functions due to forwarding login cookies in outgoing requests resulting in an attacker gaining access to cookies required to perform unauthorized actions...
CVE-2022-3082 miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling
The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...
CVE-2022-2865
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform...
CVE-2022-2865
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform...
U.S. Dept Of Defense: XSS via Client Side Template Injection on www.███/News/Speeches
Dear DoD - Team, I am able to execute javascript code on www.███████/News/Speeches. This endpoint has a search functionality with the parameter Search. The supplied value to this parameter gets embedded into the website. Furthermore the frontend of the website is presumably created with a templat...
CVE-2022-3495
A vulnerability has been found in SourceCodester Simple Online Public Access Catalog 1.0 and classified as critical. This vulnerability affects unknown code of the file /opac/Actions.php?a=login of the component Admin Login. The manipulation of the argument username/password leads to sql injectio...
CVE-2022-0030
An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privileged actions...
CVE-2022-0030 PAN-OS: Authentication Bypass in Web Interface
An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privileged actions...
CVE-2022-0030 PAN-OS: Authentication Bypass in Web Interface
An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privileged actions...
apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults
A flaw was found in Apache Commons Configuration's variable interpolation, which by default included several lookup actions that could permit script invocation on remote servers. This issue could allow an attacker to use one of these actions to send a request to execute arbitrary code on the serv...
PT-2022-5103 · Palo Alto Networks · Pan-Os
Name of the Vulnerable Software and Affected Versions: PAN-OS versions prior to 8.1.24 Description: The issue is related to an authentication bypass vulnerability in the web interface of PAN-OS, which allows a network-based attacker with specific knowledge of the target firewall or Panorama...
The vulnerability of the Build Handler component of the Jenkins Git plugin allows a perpetrator to perform arbitrary actions on a vulnerable device.
The vulnerability of the Build Handler component in the Jenkins Git plugin is related to insufficient validation of the authenticity of executed requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device by manipulating the requests made...
Improper Access Control
chromium is vulnerable to improper access control. The vulnerability is because of an incorrect security ui due to a flaw found in the Full Screen of the Chromium browser which allows an attacker to perform unauthorized actions...
[SECURITY] Fedora 36 Update: gitqlient-1.5.0-2.fc36
GitQlient, pronounced as git+client /g=EF=BF=BD=EF=BF=BDt=EF=BF=BD=EF=BF=BDk la=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDnt/ is a multi-platform Git client originally forked from QGit. Nowadays it goes beyond of just a fork and adds a lot of new functionality. Some of the major feature you can find are...
CVE-2022-39847
Use after free vulnerability in setnftpid and signalhandler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to perform malicious actions...
Authentication Bypass
sailor is vulnerable to authentication bypass. The vulnerability exists due to the performmutation function in multiple files due to improper ID type validation in mutations allowing an attacker to gain access to the system and perform unauthorized actions...
Improper Verification Of Cryptographic Signatures
sylabs sif is vulnerable to a lack of cryptographic signature validations. The vulnerability exists due to the package not verifying the hash algorithm used is cryptographically secure when verifying digital signatures allowing an attacker to perform unauthorized actions...
PT-2022-25067 · Samsung · Samsung Account
Name of the Vulnerable Software and Affected Versions: Samsung Account versions prior to 13.5.0 Description: The issue is related to an improper component protection vulnerability. This vulnerability allows attackers to perform unauthorized logout actions. Recommendations: For versions prior to...
PT-2022-5100 · Cisco · Cisco Jabber
Name of the Vulnerable Software and Affected Versions: Cisco Jabber affected versions not specified Description: A vulnerability in the Extensible Messaging and Presence Protocol XMPP message processing feature could allow an authenticated, remote attacker to manipulate the content of XMPP...