CVE-2022-1666 Secheron SEPCOS Control and Protection Relay

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

Design/Logic Flaw

wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication partners may render the iOS Wire Client partially unusable by causing it to crash multiple times on launch. These invalid accent colors can be used by and sent between Wire users. The...

Patient Records Management System SQL注入漏洞

Sourcecodester Hospital Patient Records Management System is a Web-based application that provides hospitals with an automated platform to store and manage their patient records. Management System is vulnerable to SQL injection, which originates from /hprms/admin/?page=user/manageuser&id= page...

Stored XSS in Customer Company Name

Description The application inventree is vulnerable to Stored XSS in customer company name field. Proof of Concept Video PoC Link: https://drive.google.com/file/d/11tKQzqKFobDEuqigsQYIdQhMnqSLIBsi/view?usp=sharing...

stored xss

Description Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Proof of Concept 1Go to this website: https://titra.io/ 2Click on add Track button 3In the Task field enter...

The Next Generation of Genealogy Sitebuilding SQL注入漏洞

The Next Generation of Genealogy Sitebuilding is a genealogy software in a web server.The Next Generation of Genealogy Sitebuilding version 11.1.0 and earlier versions are vulnerable to SQL injection, which can be exploited by attackers to parameter primaryID to cause SQL injection...

CVE-2022-31976

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=deleterequest...

QNAP QuTS hero XSS Vulnerability (QSA-21-63)

QNAP QuTS hero is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross-site Scripting (XSS)

@shopify/hydrogen is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the renderHydrogen function of entry-server.js when the application is built with hydrogen...

Cross-site Scripting (XSS)

Overview org.jenkins-ci:winstone is a command line wrapper around Jetty. Affected versions of this package are vulnerable to Cross-site Scripting XSS via error messages. An attacker can inject arbitrary web script or HTML by crafting malicious input that triggers these error messages. Details...

Online Sports Complex Booking System SQL注入漏洞

Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. Online Sports Complex Booking System version 1.0 is vulnerable to a SQL injection vulnerability that originates in scbs/classes/ Master.php?f=deletefacility, the id parameter of the po...

CVE-2022-29126 Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability

...

CVE-2021-27759

This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application...

CVE-2022-28606

An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server...

Kyocera d-COLOR MF3555 跨站脚本漏洞

Kyocera d-COLOR MF3555 is a color multifunction printer from Kyocera Japan.A cross-site scripting vulnerability exists in the Kyocera d-COLOR MF3555 2XDS000.002.271 device, which stems from a web application not properly checking parameters before saving them to the server, and can be exploited b...

CVE-2022-28036

AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMSadminajaxnavigation.php...

The vulnerability of the graphic editor application for Adobe Creative Cloud Desktop Application lies in insufficient validation of input data, which allows a malicious individual to escalate their privileges.

The vulnerability of the Adobe Creative Cloud Desktop Application is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain increased privileges...

CVE-2022-1178

Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4...

CVE-2022-0988 Delta Electronics DIAEnergie CLEARTEXT Transmission of Sensitive Information

Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product...

OpenBSD 安全漏洞

OpenBSD is a cross-platform, BSD-based UNIX-like operating system from the Canadian OpenBSD Openbsd project team. OpenBSD suffers from an integer sign error vulnerability that stems from a heap-based buffer overflow caused by the presence of an integer sign error in an application; no detailed...