8277 matches found
Design/Logic Flaw
In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information for example, username, email, and real name about Splunk users, when visited by another user through the drilldown component. The vulnerability requires user...
CVE-2022-37438 Information disclosure via the dashboard drilldown in Splunk Enterprise
In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information for example, username, email, and real name about Splunk users, when visited by another user through the drilldown component. The vulnerability requires user...
CVE-2022-37438
CVE-2022-37438 affects Splunk Enterprise. An authenticated user can craft a dashboard (requires access to create/share dashboards via Splunk Web) and may leak information about other Splunk users (e.g., username, email, real name) through the dashboard drilldown component. The issue is scoped to ...
CVE-2022-37438
In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information for example, username, email, and real name about Splunk users, when visited by another user through the drilldown component. The vulnerability requires user...
Stored XSS in 'Table name' field via Database information function
Description When the administrator uses the Database information function, malicious code will be accidentally called and executed through two cases: 1. 1 An internal attacker local with access right to the database could insert malicious content into the table name field by creating a table in t...
PT-2022-23997 · Splunk · Splunk Enterprise
Name of the Vulnerable Software and Affected Versions: Splunk Enterprise affected versions not specified Description: The issue allows an authenticated user to create a dashboard that could potentially leak information, such as username, email, and real name, about Splunk users when visited by...
Faraday Community - Open Source Penetration Testing and Vulnerability Management Platform
Faraday was built from within the security community, to make vulnerability management easier and enhance our work. What IDEs are to programming,Faraday is to pentesting. Offensive security had two difficult tasks: designing smart ways of getting new information, and keeping track of findings to...
CVE-2022-2769
A vulnerability, which was classified as problematic, has been found in SourceCodester Company Website CMS. This issue affects some unknown processing of the file /dashboard/contact. The manipulation of the argument phone leads to cross site scripting. The attack may be initiated remotely. The...
Security Bulletin: Operations Dashboard is vulnerable to remote connection exploit by Go CVE-2022-30629
Summary Operations Dashboard is vulnerable to remote connection exploit by Go CVE-2022-30629 with details below Vulnerability Details CVEID:CVE-2022-30629 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by an issue with session tickets generated by...
CVE-2022-2765
A vulnerability was found in SourceCodester Company Website CMS 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/settings. The manipulation leads to improper authentication. The attack can be launched remotely. The exploit ha...
Company Website CMS 代码问题漏洞
Company Website CMS is a company website/CMS by Torrahclef Personal Developer. Company Website CMS suffers from a code issue vulnerability that stems from some unknown functionality of /dashboard/add-portfolio.php being affected, where manipulation of the parameter ufile can lead to unrestricted...
Company Website CMS 跨站脚本漏洞
Company Website CMS is a company website/CMS by Torrahclef Personal Developer. Company Website CMS suffers from a cross-site scripting vulnerability that stems from some unknown handling of the file /dashboard/contact being affected, manipulation of the parameter phone can lead to cross-site...
Company Website CMS 代码问题漏洞
Company Website CMS is a company website/CMS by Torrahclef Personal Developer. A security vulnerability exists in Company Website CMS, which stems from an unknown function of the file /dashboard/add-service.php of the component Add Service Handler being affected, resulting in unrestricted uploads...
Company Website CMS 访问控制错误漏洞
Company Website CMS is a company website/CMS by Torrahclef Individual Developer. Company Website CMS 1.0 suffers from an Access Control Error vulnerability that stems from an unknown function of the file /dashboard/settings being affected, resulting in incorrect authentication and an attack that...
CVE-2022-20347
In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...
Social Slider Feed < 2.0.7 - Admin+ Stored XSS via Feeds
The plugin does not sanitise as well as escape user input in feeds, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in a Instagram Fee...
PT-2022-14572 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-12L Description: A permission bypass issue exists due to a confused deputy in the ConnectedDeviceDashboardFragment.java file. This could lead to remote escalation of privilege in Bluetooth settings...
CVE-2022-2386
The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...
