CVE-2022-35611

A Cross-Site Request Forgery CSRF in MQTTRoute v3.3 and below allows attackers to create and remove dashboards...

CVE-2022-35612

A cross-site scripting XSS vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the dashboard name text field...

MQTT 跨站请求伪造漏洞

MQTT Message Queuing Telemetry Transport is an ISO standard ISO/IEC PRF 20922 based on the Publish/Subscribe paradigm of messaging protocols, which works on the TCP/IP family of protocols, and is designed for remote devices with low hardware performance and poor network conditions. It works on th...

MQTT 跨站脚本漏洞

MQTT Message Queuing Telemetry Transport is an ISO standard ISO/IEC PRF 20922 based on the Publish/Subscribe paradigm of messaging protocols, which works on the TCP/IP family of protocols, and is designed for remote devices with low hardware performance and poor network conditions. It works on th...

CVE-2022-42238

A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard...

CVE-2022-42238

A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard...

Privilege escalation

A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard...

Dapr Dashboard Access Control Error Vulnerability

Dapr Dashboard is a web-based user interface for Dapr that allows users to view information, view logs of running Dapr applications, components, configurations, etc. Dapr Dashboard 0.1.0 and later, 0.10.0 and earlier versions have an access control error vulnerability that stems from the existenc...

PT-2022-26326 · Unknown · Merchandise Online Store

Name of the Vulnerable Software and Affected Versions: Merchandise Online Store version 1.0 Description: A Vertical Privilege Escalation issue allows an attacker to gain access to the admin dashboard. Recommendations: For Merchandise Online Store version 1.0, at the moment, there is no informatio...

Merchandise Online Store 安全漏洞

Merchandise Online Store is a Merchandise Online Store system by Carlo Montero Personal Developer. A security vulnerability exists in Merchandise Online Store version v.1.0, which stems from a vertical privilege escalation issue that allows an attacker to access the administrative dashboard...

CVE-2022-42238

A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard...

PT-2022-6441 · Nokia · Nokia Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct versions prior to 22 FP2211 Description: The issue is related to insufficient protection of the web page structure when creating tasks. It allows an attacker to perform cross-site scripting XSS attacks by injecting scripts. The...

PT-2022-05: Stored Cross-Site Scripting (XSS)

Input validation was missing while creating the schedule task in alarm reports dashboard. An attacker can create a script to inject XSS. The attack can only be performed by an internal user. The vulnerability is fixed in NetAct 22 FP2211 and onwards. Advisory status 10.10.2022 - Vendor gets...

PT-2022-01: XML External Entity (XXE)

Input validation and proper XML parsers configuration was missing. On the Configuration Dashboard page, an attacker can import XML files. Support of external entities External Entity is enabled for processing of such files, which leads to Arbitrary File Read and SSRF. The attack can only be...

PT-2022-6445 · Nokia · Nokia Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct versions prior to 22 FP2211 Description: An XXE issue was discovered via an XML document to the Configuration Dashboard page, where input validation and a proper XML parser configuration are missing. This makes it difficult for a...

@magicfinn/gatsby-theme-finn-default (>=1.0.0, <=2.0.40), @panstav/ozen-dashboard-shared (>=0.0.2, <=0.0.7) potentially affected by CVE-2022-35923 via v8n (>=1.2.3, <=1.3.3)

v8n NPM version =1.2.3, =1.0.0, =0.0.2, =0.0.7 Source cves: CVE-2022-35923 Source advisory: OSV:GHSA-XRX9-GJ26-5WX9...

Information Disclosure

Dapr dashboard is vulnerable to information disclosure. The vulnerability is due to the dashboard's access control not being properly configured, resulting in an attacker gaining access to obtain sensitive plaintext configuration of redis, mongodb, rabbitmq and other applications on the cloud...

Qualys Performance Tuning Series – Remove Stale Assets for Best Performance

As organizations transition to the cloud, their cloud environments and assets rapidly grow. Many of the assets within the cloud are ephemeral in nature, they exist for a few minutes, hours or days and then are terminated. These transitory assets pose a unique challenge from an asset and...

GHSA-2W6M-Q946-399R Dapr Dashboard vulnerable to Incorrect Access Control

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...

Dapr Dashboard vulnerable to Incorrect Access Control

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...