Code injection via property expansion in SoapUI

The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file...

GHSA-QPHH-5FV5-2MJJ Plone is vulnerable to information exposure via the object manager implementation

The object manager implementation objectmanager.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request...

GHSA-RRMF-FPMM-JPWR ViMbAdmin CSRF Vulnerabilities

Multiple cross-site request forgery CSRF vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to 1. add an administrator user via a crafted POST request to...

Cisco Firepower Management Center Software Information Disclosure (cisco-sa-fmc-infdisc-guJWRwQu)

A vulnerability in the input protection mechanisms of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to view data without proper authorization. This vulnerability exists because of a protection mechanism that relies on the existence or values of a...

GHSA-8QQ4-8JVQ-MFW4 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request...

GHSA-M63H-Q4X3-6HWJ Moodle is vulnerable to Improper Input Validation in MoodleQuickForm class

The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request...

Moodle is vulnerable to Improper Input Validation in MoodleQuickForm class

The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request...

baserCMS Access Control Bypass

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

GHSA-V9GF-98VR-MGP2 baserCMS Access Control Bypass

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

GHSA-F7CR-7C2C-FM8R OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

The ironic-api service in OpenStack Ironic before 4.2.5 Liberty and 5.x before 5.1.2 Mitaka allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the...

CVE-2022-26020

An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability...

InHand Networks InRouter Series 安全漏洞

InHand Networks InRouter Series is a series of routers from InHand Networks, U.S.A. An elevation of privilege vulnerability exists in the InHand Networks InRouter302 V3.5.4 release, which could be exploited by an attacker to cause an increase in privileges via a specially crafted HTTP request...

Cross site request forgery (csrf)

The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 File Transfer allows an unauthenticated attacker to obtain sensitive data related to the content of transferred files via a crafted HTTP request...

CVE-2022-22454

IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request...

Cross site request forgery (csrf)

IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request...

PT-2022-15443 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. Recommendations: For IBM InfoSphere Information...

CVE-2022-22454

IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request...

CVE-2021-31559

A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders...

CVE-2021-42192

Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation...

KONGA 安全漏洞

KONGA is a full-featured, open source, multi-user GUI from the Dutch individual developer Panagis Tselentis. A security vulnerability exists in KONGA version v0.14.9 that stems from incorrect access control. An attacker can exploit this vulnerability to elevate privileges via a specially crafted...