GHSA-RV48-V862-MP92 Magento OS Command Injection

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for...

Dolibarr Cross Site Request Forgery (CSRF)

Dolibarr 7.0.0 is affected by: Cross Site Request Forgery CSRF. The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access...

GHSA-HWMC-V6J6-GC2P Dolibarr Cross Site Request Forgery (CSRF)

Dolibarr 7.0.0 is affected by: Cross Site Request Forgery CSRF. The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access...

GHSA-GC62-J469-9GJM Rancher Privilege Escalation Vulnerability

In Rancher 1 and 2 through 2.2.3, unprivileged users if allowed to deploy nodes can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as...

Rancher Privilege Escalation Vulnerability

In Rancher 1 and 2 through 2.2.3, unprivileged users if allowed to deploy nodes can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as...

Telecommunication Software SAMwin Contact Center Suite 安全漏洞

Telecommunication Software SAMwin Contact Center Suite is a highly versatile and flexible contact center software solution from Telecommunication Software. A security vulnerability exists in Telecommunication Software SAMwin Contact Center Suite version 5.1. The vulnerability stems from a conflic...

CVE-2022-1320

The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-29448

Authenticated admin or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Herd Effects plugin = 5.2 at WordPress...

PT-2022-2704 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.4.0 through 2.1.14 Argo CD versions 2.2.0 through 2.2.8 Argo CD versions 2.3.0 through 2.3.3 Description: A critical issue has been discovered in Argo CD that allows unauthenticated users to impersonate as any Argo CD user ...

CVE-2022-30618

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users from:users-permissions. There are many scenarios in whic...

CVE-2021-37413

GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerability to obtain administrative access to the webpage, access the user database, modify web content and upload custom files. The backend login...

CVE-2022-30018

Mobotix Control Center MxCC through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file. The credential storage method in this software enables an attacker/user of the machine to gain admin access to the software and gain access...

CVE-2022-30018

Mobotix Control Center MxCC through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file. The credential storage method in this software enables an attacker/user of the machine to gain admin access to the software and gain access...

Design/Logic Flaw

Mobotix Control Center MxCC through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file. The credential storage method in this software enables an attacker/user of the machine to gain admin access to the software and gain access...

CVE-2022-30018

Mobotix Control Center MxCC through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file. The credential storage method in this software enables an attacker/user of the machine to gain admin access to the software and gain access...

GRANDCOM DynWEB SQL注入漏洞

GRANDCOM DynWEB is the login management interface for a content management system from GRANDCOM Slovakia. A security vulnerability exists in GRANDCOM DynWEB versions prior to 4.2, which stems from a back-end login script that does not validate and clean up user-supplied strings. An unauthenticate...

PT-2022-19974 · Mobotix · Mobotix Control Center

Name of the Vulnerable Software and Affected Versions: Mobotix Control Center MxCC versions 2.5.4.5 and earlier Description: The issue concerns insufficiently protected credentials, where passwords are stored in a recoverable format via the MxCC.ini config file. This enables an attacker to gain...

PT-2022-5038 · Hitachi Energy · Microscada X Sys600

Name of the Vulnerable Software and Affected Versions: Hitachi Energy MicroSCADA X SYS600 versions 10 through 10.3.1 Description: The issue is caused by improper input validation in a specific configuration file, leading to a buffer-overflow. This can cause the SYS600 to fail to start. The...

PT-2022-2603

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access, Identity Manager and vRealize Automation affected versions not specified Description The issue is related to an authentication bypass vulnerability affecting local domain users. A malicious actor with network acces...

CVE-2022-0997

Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a...