PT-2022-24074 · Unknown · Simple Online Book Store System

Name of the Vulnerable Software and Affected Versions: Simple Online Book Store System version 1.0 Description: The issue concerns Cross Site Scripting XSS in the /admin book.php file, where the Title, Author, and Description parameters are vulnerable. This allows for potential malicious script...

CVE-2022-37731

ftcms 2.1 poster.PHP has a XSS vulnerability. The attacker inserts malicious JavaScript code into the web page, causing the user / administrator to trigger malicious code when accessing...

CVE-2022-2718

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-page-extrafields page in versions up to, and including, 5.2.5 due to insufficient escaping on the user supplied parameter and lack of...

PT-2022-19562 · WordPress · Image Hover Effects Ultimate

Name of the Vulnerable Software and Affected Versions: Image Hover Effects Ultimate plugin for WordPress versions up to, and including, 9.7.3 Description: The issue arises from insufficient input sanitization and output escaping in the Video Link values that can be added to an Image Hover. This...

PT-2022-4843

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One and Trend Micro Apex One as a Service affected versions not specified Description The issue is related to improper validation of components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as...

UBUNTU-CVE-2022-39049

An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS...

UBUNTU-CVE-2022-39050

An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external...

OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass

The plugin does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address PoC POST / HTTP/1.1...

PT-2022-18573 · WordPress · Fast Flow Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Fast Flow WordPress plugin versions prior to 1.2.13 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...

VulnCheck KEV: CVE-2022-4980

General Bytes Crypto Application Server CAS beginning with version 20201208 prior to 20220531.38 backport and 20220725.22 mainline contains an authentication bypass in the admin web interface. An unauthenticated attacker could invoke the same URL used by the product's default-installation /...

CVE-2022-36117

An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for an administrative function. If...

CVE-2022-2463 ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22

Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of the ISaGRAF Workbench software when opened. If the software is running at the SYSTEM leve...

Blue Prism Enterprise 安全漏洞

Blue Prism Enterprise is an intelligent robotic process automation RPA software from Blue Prism UK. A security vulnerability exists in Blue Prism Enterprise versions 6.0 through 7.01 that stems from the possibility that an authenticated user could reverse engineer the Blue Prism software to...

CVE-2022-35909

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality...

CVE-2022-35910

In Jellyfin before 10.8, stored XSS allows theft of an admin access token...

Cross site scripting

In Jellyfin before 10.8, stored XSS allows theft of an admin access token...

CVE-2022-35910

CVE-2022-35910 : The provided documents describe a stored XSS vulnerability in Jellyfin before version 10.8 that enables theft of an admin access token. The description does not specify the exact component, file, or version other than the product and pre-10.8 range, nor does it include explicit r...

CVE-2022-35910

In Jellyfin before 10.8, stored XSS allows theft of an admin access token...

Jellyfin 安全漏洞

Jellyfin is a freeware media system. It allows you to control the management and streaming of media. It is an alternative to the proprietary Emby and Plex, and can serve media from dedicated servers to end-user devices through multiple applications. A security vulnerability exists in versions of...

PT-2022-23481 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: jizhicms version 2.3.1 Description: An issue was discovered that allows for a CSRF vulnerability, which can be exploited to add an admin. Recommendations: For jizhicms version 2.3.1, as a temporary workaround, consider implementing CSRF...