CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

8 matches found

CNNVD•added 2022/01/20 12:0 a.m.•1 views

code-projects Pharmacy Management SQL注入漏洞

code-projects Pharmacy Management is a pharmacy management system. A SQL injection vulnerability exists in code-projects Pharmacy Management because the username parameter in the product administrator login form does not effectively filter special characters in the input data. The vulnerability c...

9.8CVSS8.6AI score0.00307EPSS

Exploits1References2

NVD•added 2020/09/09 7:15 p.m.•11 views

CVE-2020-15785

A vulnerability has been identified in Siveillance Video Client All versions. In environments where Windows NTLM authentication is enabled the affected client application transmits usernames to the server in cleartext. This could allow an attacker in a privileged network position to obtain valid...

5.3CVSS0.00355EPSS

Exploits0References2

Prion•added 2020/06/04 7:15 p.m.•9 views

Privilege escalation

Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/Users/Edit/:UserId fails to check that the request was submitted by an Administrator. This allows a normal user to escalate their privileges by adding additional...

6.5CVSS8.9AI score0.00186EPSS

Exploits3References3Affected Software1

CVE•added 2020/06/04 6:31 p.m.•57 views

CVE-2020-11679

Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation via Adminstrator/Users/Edit/:UserId, where requests aren’t checked for admin authority, enabling a normal user to add roles and gain administrator privileges. The issue is fixed in v1.0.1 per linked disclosures; CVSS data in sources ...

8.8CVSS8.9AI score0.00186EPSS

Exploits3References3Affected Software1

Prion•added 2019/08/14 5:15 p.m.•18 views

Design/Logic Flaw

Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway MWG 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-Options HTTP header...

5.8CVSS6.8AI score0.00273EPSS

Exploits0References1Affected Software1

Cvelist•added 2019/08/14 4:20 p.m.•11 views

CVE-2019-3639 MWG UI: Cross-Frame Scripting vulnerability

7.1CVSS6.8AI score0.00273EPSS

Exploits0References1

Cvelist•added 2019/07/24 2:28 p.m.•12 views

CVE-2019-3595 DLP Endpoint ePO extension not sanitizing CSV exports

Improper Neutralization of Special Elements used in a Command 'Command Injection' in ePO extension in McAfee Data Loss Prevention DLP 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is...

2CVSS6.8AI score0.00192EPSS

Exploits0References2