GHSA-CR3Q-658V-QV3X OpenCart-Overclocked Cross-site Scripting Vulnerability

Reflected Cross-Site Scripting XSS may allow an attacker to execute JavaScript code in the context of the victim’s browser. This may lead to unauthorised actions being performed, unauthorised access to data, stealing of session information, denial of service, etc. An attacker needs to coerce a us...

Information Disclosure

eventsource is vulnerable to information disclosure. The vulnerability exists in few function in eventsource.js due to the leakage of cookies and authorization headers to external sites which allows an attacker to steal user credentials and perform unauthorized actions...

Improper Privilege Management

Overview katello is a package that adds Content and Subscription Management to Foreman Affected versions of this package are vulnerable to Improper Privilege Management due to not respecting filtering on Product Name when actions are performed via hammer using the repository id. Remediation Upgra...

Cross-Site Request Forgery in hawtio

It was found that hawtio contains a CSRF flaw that allows unrelated websites to perform actions as the authenticated user. Attackers could use this vulnerability to trick the user to visit his website that contains a malicious script which can be submitted to hawtio server on behalf of the user...

Improper Neutralization of Input During Web Page Generation in Jenkins

A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other us...

Tieba-Cloud-Sign 跨站脚本漏洞

Tieba-Cloud-Sign Baidu Post Bar Cloud Sign is a Chinese MoeNet open source configuration on the server without any operation can be realized without any operation of the full-automatic post bar signing. Tieba-Cloud-Sign v4.9 security vulnerabilities , attackers can use the vulnerability to inject...

Improper Access Control

microweber/microweber is vulnerable to improper access control. The vulnerability exists in index.blade.php due to lack of validations in emails confirmation which allows an attacker to view data and perform unauthorized actions such as registering accounts and modifying confidential information...

CVE-2022-29882

A vulnerability has been identified in SICAM T All versions V3.0. Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of this situation to store an XSS attack, which could - when a legitimate user accesses the error logs - perform arbitrary...

CVE-2022-29882

CVE-2022-29882 affects Siemens SICAM T (all versions

CVE-2022-29880

A vulnerability has been identified in SICAM T All versions V3.0. Affected devices do not properly validate input in the configuration interface. This could allow an authenticated attacker to place persistent XSS attacks to perform arbitrary actions in the name of a logged user which accesses the...

InHand Networks InRouter302 信任管理问题漏洞

InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. InHand Networks InRouter302 version 3.5.37 contains a hard-coded credential vulnerability that could be exploited by an attacker to send specially crafted network requests that could lead to the execution of...

CVE-2022-0814

The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections...

Note Press <= 0.1.10 - Admin+ SQLi via Bulk Actions

The plugin does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection PoC...

Note Press <= 0.1.10 - Admin+ SQLi via Bulk Actions

The plugin does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection...

Note Press <= 0.1.10 - Admin+ SQLi via id

The plugin does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections https://example.com/wp-admin/admin.php?page=NotePress-Main-Menu&action=view&id=17+AND+SELECT+3630+FROM+SELECTSLEEP5KdTt...

PT-2022-19165 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 11.2.1.53537 Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious...

QNAP QTS Video Station Multiple Vulnerabilities (QSA-22-14)

QNAP Video Station is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:qnap:videostation"; if...

Privilege Escalation

njs is vulnerable to privilege escalation. The vulnerability exists in njspromiseperformthen function due to a type confusion which allows an attacker to gain access to the system and perform unauthorized actions...

IBM Cloud Pak for Business Automation访问控制错误漏洞

IBM Cloud Pak for Business Automation is a set of modular, integrated software components from International Business Machines Corporation IBM built for any hybrid cloud, designed to automate work and accelerate business growth.IBM Cloud Pak for Business Automation is vulnerable to an access...

CVE-2021-27759

This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application...