1371 matches found
CVE-2022-0024
A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committ...
CVE-2021-36844
Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in MyThemeShop WP Subscribe plugin = 1.2.12 on WordPress...
CVE-2022-29422
Multiple Authenticated admin+ Persistent Cross-Site Scripting XSS vulnerabilities in Adam Skaat's Countdown & Clock plugin = 2.3.2 at WordPress via &ycd-countdown-width;, &ycd-progress-height;, &ycd-progress-width;, &ycd-button-margin-top;, &ycd-button-margin-right;, &ycd-button-margin-bottom;,...
CVE-2022-29418
Authenticated admin user role Persistent Cross-Site Scripting XSS in Mark Daniels Night Mode plugin = 1.0.0 on WordPress via vulnerable parameters: &ntmodepagesettingenable-me, &ntmodepagesettingbg-color, &ntmodepagesettingtxt-color, &ntmodepagesettinganccolor...
CVE-2022-28743
Time-of-check Time-of-use TOCTOU Race Condition vulerability in Foscam R2C IP camera running System FW = 1.13.1.6, and Application FW = 2.91.2.66, allows an authenticated remote attacker with administrator permissions to execute arbitrary remote code via a malicious firmware patch. The impact of...
CVE-2022-27848
Authenticated admin+ user Stored Cross-Site Scripting XSS in Modern Events Calendar Lite WordPress plugin = 6.5.1...
CVE-2021-36846
Authenticated admin or higher user role Stored Cross-Site Scripting XSS vulnerability in Premio Chaty WordPress plugin = 2.8.3...
CVE-2022-27845
Authenticated admin or higher user role Stored Cross-Site Scripting XSS in PlausibleHQ Plausible Analytics WordPress plugin = 1.2.2...
CVE-2022-25618
Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in wpDataTables WordPress plugin versions = 2.1.27...
CVE-2022-25618
Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in wpDataTables WordPress plugin versions = 2.1.27...
CVE-2021-33523
MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary commands on the underlying host. This occurs in com.idsscheer.ppmmashup.business.jdbc.DriverUploadController...
CVE-2022-28223
Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin...
CVE-2022-28223
Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin...
CVE-2022-0499
The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones...
CVE-2022-25225
Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation PostgreSQL by exploiting this issue...
CVE-2022-25225
Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation PostgreSQL by exploiting this issue...
CVE-2022-25225
Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation PostgreSQL by exploiting this issue...
CVE-2022-26484
An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize admin/cgi-bin/rulemgr.pl/getfile/ input data, allowing a remote authenticated administrator to read arbitrary files on the system via...
CVE-2022-26484
An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize admin/cgi-bin/rulemgr.pl/getfile/ input data, allowing a remote authenticated administrator to read arbitrary files on the system via...