1777 matches found
CVE-2022-2634 Digi ConnectPort X2D
An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...
webdesenvolvimento.com.br Cross Site Scripting vulnerability OBB-2832695
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2022-4144 · Intel · Intel Datacenter Group Event Android Application
Name of the Vulnerable Software and Affected Versions: IntelR Datacenter Group Event Android application, all versions Description: The issue is related to uncontrolled search path elements in the IntelR Datacenter Group Event Android application. This may allow an authenticated user to potential...
Denial Of Service
libtiff.so is vulnerable to denial of service DoS attacks. A malicious user is able to cause denial of service conditions via a crafted TIFF file through TIFFVGetField function, resulting in an application crash...
Oracle Fusion Middleware 输入验证错误漏洞
Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle USA. The platform provides middleware, software collections, and other capabilities. An input validation error vulnerability exists in Oracle Fusion...
Stored xss in "users name","functions name","storage buckets name" and in "database collections name"
Description Appwrite application allows malicious javascript payload to inject in users name,functions name,storage buckets name and in database collections name which leads to Stored XSS. Proof of Concept 1.Login to the application 2.Go to the "users name","functions name","storage buckets name"...
CVE-2022-1666 Secheron SEPCOS Control and Protection Relay
The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...
Design/Logic Flaw
wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication partners may render the iOS Wire Client partially unusable by causing it to crash multiple times on launch. These invalid accent colors can be used by and sent between Wire users. The...
Patient Records Management System SQL注入漏洞
Sourcecodester Hospital Patient Records Management System is a Web-based application that provides hospitals with an automated platform to store and manage their patient records. Management System is vulnerable to SQL injection, which originates from /hprms/admin/?page=user/manageuser&id= page...
Stored XSS in Customer Company Name
Description The application inventree is vulnerable to Stored XSS in customer company name field. Proof of Concept Video PoC Link: https://drive.google.com/file/d/11tKQzqKFobDEuqigsQYIdQhMnqSLIBsi/view?usp=sharing...
stored xss
Description Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Proof of Concept 1Go to this website: https://titra.io/ 2Click on add Track button 3In the Task field enter...
The Next Generation of Genealogy Sitebuilding SQL注入漏洞
The Next Generation of Genealogy Sitebuilding is a genealogy software in a web server.The Next Generation of Genealogy Sitebuilding version 11.1.0 and earlier versions are vulnerable to SQL injection, which can be exploited by attackers to parameter primaryID to cause SQL injection...
CVE-2022-31976
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=deleterequest...
QNAP QuTS hero XSS Vulnerability (QSA-21-63)
QNAP QuTS hero is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Cross-site Scripting (XSS)
@shopify/hydrogen is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the renderHydrogen function of entry-server.js when the application is built with hydrogen...
Cross-site Scripting (XSS)
Overview org.jenkins-ci:winstone is a command line wrapper around Jetty. Affected versions of this package are vulnerable to Cross-site Scripting XSS via error messages. An attacker can inject arbitrary web script or HTML by crafting malicious input that triggers these error messages. Details...
Online Sports Complex Booking System SQL注入漏洞
Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. Online Sports Complex Booking System version 1.0 is vulnerable to a SQL injection vulnerability that originates in scbs/classes/ Master.php?f=deletefacility, the id parameter of the po...
CVE-2022-29126 Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability
...
CVE-2021-27759
This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application...
