HP FutureSmart 安全漏洞

HP FutureSmart is a printer application from Hewlett-Packard HP USA. It allows your existing compatible HP devices to be equipped with the same features as next-generation devices. A security vulnerability exists in HP FutureSmart. An attacker has exploited the vulnerability to cause a denial of...

CVE-2022-45010

Simple Phone Book/Directory Web App v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /PhoneBook/edit.php...

webTareas SQL注入漏洞

webTareas is a web-based open source collaboration tool. The product supports features such as project management, bug tracking, content management and meeting management. A security vulnerability exists in webTareas version 2.4p5, which originates from an SQL injection via the id parameter in...

PUB-A-220733496

In onPreferenceClick of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the Settings app due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

Cross site request forgery (csrf)

Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application. This is possible because the application is vulnerable to CSRF...

CVE-2022-44786

An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the href parameter to specify the JSP page to be rendered. This affects ApriPagina.do POST and GET requests to each application...

CVE-2022-43279

Summary: CVE-2022-43279 affects LimeSurvey prior to 5.0.4. A SQL injection vulnerability exists in the server-side component at /application/views/themeOptions/update.php, enabling unauthenticated or authenticated user interaction depending on context as described in sources. The issue arises fro...

CVE-2022-31689

VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token...

CVE-2022-42744

CVE-2022-42744 affects CandidATS at version 3.0.0. The root cause is improper validation of the entriesPerPage parameter, enabling an external attacker to perform CRUD operations on the application databases via SQL injection. Impact is high: confidentiality, integrity, and availability are all c...

CVE-2022-3310

Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the user to install an application to bypass same origin policy via a crafted application. Chromium security severity: Medium...

Information Disclosure

github.com/relatedcode/messenger is vulnerable to information disclosure. The vulnerability exists because application exposes the session data of the users of the application to the public which allows an attacker to access sensitive data of any user in the application...

Design/Logic Flaw

Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. This is possible because the application exposes user data to the public...

CVE-2022-41707

The CVE-2022-41707 entry concerns Relatedcode’s Messenger (version 7bcd20b). Affected component: Messenger app data handling that exposes user data publicly. Root cause: information disclosure allowing an authenticated external attacker to access sensitive data of any user. Impact: Confidentialit...

CVE-2022-41540

The web app client of TP-Link AX10v1 V1211117 uses hard-coded cryptographic keys when communicating with the router. Attackers who are able to intercept the communications between the web client and router through a man-in-the-middle attack can then obtain the sequence key via a brute-force attac...

CVE-2022-41194

The CVE-2022-41194 entry describes a denial-of-service issue in SAP 3D Visual Enterprise Viewer (version 9) caused by improper memory management when processing manipulated Encapsulated PostScript (.eps, ai.x3d) files from untrusted sources. The vulnerability can cause the application to crash an...

Weak password policy : Old password can be set as new password

Description Rdiffweb has a weak password implementation , where a new password set by the user can be same to the old password Proof of Concept 1 Go to https://rdiffweb-demo.ikus-soft.com/prefs/general end point 2 Change your password Set your new password similar to old password you will notice...

Pimcore vulnerable to cross site scripting

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can perform any action within the application that the user can perform; view any information that the user is able to view; modify...

PT-2022-21361 · Pimcore +2 · Pimcore +1

Name of the Vulnerable Software and Affected Versions: No specific software name is mentioned, but based on the information provided, the affected software is likely a web application. Since the affected versions are not explicitly mentioned, the output will be: Web application affected versions...

CVE-2022-39821

In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem...

Out-of-bounds Write

A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidicaprtltounicode function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the --caprtl option, leading to a crash and...