6730 matches found
CVE-2022-35291
Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successfu...
CVE-2022-35291
Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successfu...
CVE-2022-35291
Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successfu...
Design/Logic Flaw
Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successfu...
Command injection
OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter e.g., through an email attachment...
CVE-2022-35291
The CVE-2022-35291 entry describes a privilege-escalation vulnerability in SAP SuccessFactors via misconfigured attachment API endpoints used by the SF Mobile app (Time Off, Time Sheet, EC Workflow, Benefits). The underlying issue is endpoint misconfiguration that allows attackers with user privi...
CVE-2022-23100
CVE-2022-23100 affects Open-Xchange OX App Suite up to version 7.10.6, where the vulnerability exists in the Documentconverter component allowing OS command injection. An authenticated OX App Suite user can trigger a document conversion (e.g., via an email attachment or OX Drive content) and exec...
CVE-2022-23100
OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter e.g., through an email attachment...
CVE-2022-23100
OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter e.g., through an email attachment...
CVE-2022-34551
Sims v1.0 was discovered to allow path traversal when downloading attachments...
PT-2022-22202 · Sims · Sims
Name of the Vulnerable Software and Affected Versions: Sims version 1.0 Description: The issue allows path traversal when downloading attachments. Recommendations: For Sims version 1.0, consider restricting access to attachment downloads until a patch is available...
Cross-Site Scripting (XSS)
Best Practical Request Tracker is vulnerable to cross-site scripting. The vulnerability exists via a crafted content type for an attachment which allows an attacker to inject and execute arbitrary javascript...
CVE-2022-29454 WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in WordPlus Better Messages plugin = 1.9.9.148 at WordPress allows attackers to upload files. File attachment to messages must be activated...
CVE-2022-25802
Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...
DEBIAN-CVE-2022-25802
Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...
Design/Logic Flaw
Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...
CVE-2022-25802
Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...
UBUNTU-CVE-2022-25802
Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...
