3093 matches found
CVE-2022-31969
ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simplechatbot/admin/?page=user/manageuser&id=...
CVE-2022-31338
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/user/index.php?view=edit&id=...
CVE-2022-31338
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/user/index.php?view=edit&id=...
Moderate: Red Hat Security Advisory: ACS 3.70 enhancement and security update
Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes RHACS. The updated image includes bug fixes and feature improvements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score...
CVE-2022-32010: Improper Neutralization of Special Elements used in an SQL Command
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/user/index.php?view=edit&id=...
PT-2022-21038
Name of the Vulnerable Software and Affected Versions Complete Online Job Search System version 1.0 Description The issue is related to SQL Injection via the "/eris/admin/user/index.php?view=edit&id=" endpoint. The id variable is vulnerable to SQL injection attacks. No information is provided abo...
CVE-2022-31338: Improper Neutralization of Special Elements used in an SQL Command
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/user/index.php?view=edit&id=...
PT-2022-20695
Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue allows for SQL Injection via the /ordering/admin/user/index.php?view=edit&id= API endpoint, specifically targeting the id variable. This could potentially lead to unauthorized access o...
CVE-2022-1564
The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2022-1645: Improper Neutralization of Input During Web Page Generation
The Amazon Link WordPress plugin through 3.2.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
Design/Logic Flaw
ManageEngine AppManager15 Build No:15510 allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality...
CVE-2022-23050
ManageEngine AppManager15 Build No:15510 allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality...
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting XSS vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder. As per the Magento Release 2.3.3, if you have already implemented the pre-release versi...
GHSA-J63V-WCF9-C9HM Magento 2 Community Edition RCE Vulnerability
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated admin user with import product privileges can delete files through bulk product import and inject code into XSLT file. The combination of these...
Magento 2 Community Edition RCE Vulnerability
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated admin user with import product privileges can delete files through bulk product import and inject code into XSLT file. The combination of these...
Magento 2 Community Edition XSS Vulnerability
A reflected cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when adding an image for during simple product creation...
GHSA-29MR-GR4C-VF9C Magento 2 Community Edition XSS Vulnerability
A reflected cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when adding an image for during simple product creation...
Trend Micro Password Manager vulnerable to privilege escalation
Overview Trend Micro Incorporated has released a security update for Trend Micro Password Manager. Trend Micro Incorporated reported the vulnerability to JPCERT/CC to notify users of the solutions through JVN. Impact A non-administrative user of the system where the affected product is installed...
PT-2022-12464 · Luxsoft · Luxcal Web Calendar
Name of the Vulnerable Software and Affected Versions: LuxSoft LuxCal Web Calendar versions prior to 5.2.0 Description: An unauthenticated attacker can manipulate a POST request, allowing the attacker's session to be authenticated as any registered LuxCal user, including the site administrator...
