CVE-2023-27270

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain...

CVE-2023-25618

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an unused class for error handling in which an attacker authenticated as a non-administrative user can craft a request with...

Design/Logic Flaw

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain...

PT-2023-16952 · Sourcecodester · Sourcecodester Yoga Class Registration System

Name of the Vulnerable Software and Affected Versions: SourceCodester Yoga Class Registration System version 1.0 Description: A vulnerability was found in the SourceCodester Yoga Class Registration System. It affects the function query of the file admin/user/list.php. The manipulation of the name...

CVE-2023-1395: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affects the function query of the file admin/user/list.php. The manipulation of the argument name leads to cross site scripting. The attack can be initiated...

Atlassian Jira < 6.0.5 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 6.0.5. It is, therefore, affected by multiple vulnerabilities: - A directory traversal in the Importers Plugin which permits remote attackers to create arbitrary files...

CVE-2023-25223

CRMEB =1.3.4 is vulnerable to SQL Injection via /api/admin/user/list...

CVE-2023-25223

CRMEB =1.3.4 is vulnerable to SQL Injection via /api/admin/user/list...

Zhongbang CRMEB SQL注入漏洞

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang in Xi'an, China. A security vulnerability exists in CRMEB version 1.3.4 and earlier versions, which originated from an SQL injection attack via /api/admin/user/list...

CVE-2023-25223: Improper Neutralization of Special Elements used in an SQL Command

CRMEB =1.3.4 is vulnerable to SQL Injection via /api/admin/user/list...

CVE-2023-25223

CRMEB =1.3.4 is vulnerable to SQL Injection via /api/admin/user/list...

Stored Cross-site Scripting (XSS)

github.com/grafana/grafana is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to map attributes in the Geomap plugin which library does not properly sanitize, allowing an attacker with an editor role to inject and execute malicious JavaScript. If an admin user clicks on the m...

Music Gallery Site 1.0 Privilege Escalation / Missing Authentication Vulnerabilities

Music Gallery Site - Broken Access Control leads to compromise of complete application by adding admin user without log-in into the application. CVE Assigned: CVE-2023-0963 mitre.org nvd.nist.org Author Email: email protected Vendor Homepage: https://www.sourcecodester.com Software Link: Music...

Auto Dealer Management System 1.0 SQL Injection Vulnerability

Auto Dealer Management System - SQL Injection on page viewtransaction.php and parameter is id, application url is ?page=vehicles/viewtransaction&id=? with low privilege authentication CVE Assigned: CVE-2023-0912 mitre.org nvd.nist.org Author Name: Muhammad Navaid Zafar Ansari Author Email:...

CVE-2023-0999

A vulnerability classified as problematic was found in SourceCodester Sales Tracker Management System 1.0. This vulnerability affects unknown code of the file admin/?page=user/list. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been...

Music Gallery Site 1.0 Privilege Escalation / Missing Authentication

Music Gallery Site - Broken Access Control leads to compromise of complete application by adding admin user without log-in into the application. Date: 21 February 2023 CVE Assigned: CVE-2023-0963 mitre.org nvd.nist.org Author Email: [email protected] Vendor Homepage:...

Admin Able To Perform Operations On Themselves By Interacting With API

Description When setting a password through /admin/users URI, the admin is not allowed to set their own new password through this URI. If they attempt to do so, they receive an error stating Forbidden to operate on yourself. But this is easily bypassable by interacting with the API: if you set a...

K06024431: BIG-IQ vulnerability CVE-2021-23024

Security Advisory Description The BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. CVE-2021-23024 Impact This vulnerability allows an authenticated admin user or a user account assigned with an administrator role and no shell access to...

K25434422: NGINX Controller vulnerability CVE-2020-5899

Security Advisory Description Recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of...

K14812883: BIG-IP ASM XSS vulnerability CVE-2019-6607

Security Advisory Description This is a stored cross-site scripting XSS vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF, which results in code execution as the admin user. CVE-2019-6607 The user levels that can store this atta...