Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System 1.0 is vulnerable to SQL Injection via the date parameter. id: CVE-2022-31879 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat,j4vaovo severity: high description: | Online Fire Reporting System 1.0 is vulnerable to SQL Injection via t...

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/managerequest&id=. id: CVE-2022-31983 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: high description: | Online Fire Reporting System v1.0 is vulnerable to...

CVE-2023-2299 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.4.2 due to a missing capability check on the processAction...

CVE-2023-29722

The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker cou...

CVE-2023-29732

SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Dependi...

PT-2023-22605

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 17.0.1 Zyxel ATP Series, USG FLEX Series, USG FLEX 50W Series, and USG20W-VPN Series affected versions not specified Description The issue allows remote code execution by an authenticated user via an uppercase...

EFB vulnerability in Lufthansa’s Lido eRouteManual

Almost all commercial airlines now use electronic flight bags EFBs to drive efficiency and safety in their operations. We’ve been testing the security of EFBs and their apps, here’s our latest findings. TL;DR Many airlines use Lufthansa Systems Lido eRoute Manual for their EFB approach plates. We...

CVE-2022-47984 IBM InfoSphere Information Server SQL injection

IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 243163...

Vulnerabilities fixed in Cisco Identity Services Engine (ISE).

Cisco has fixed vulnerabilities in Identity Services Engine ISE. A malicious party can exploit the vulnerabilities to perform attacks that could result in the following categories of damage: Manipulation of data. Circumvention of security measure Remote code execution Administrator/Root rights...

CVE-2023-31597

An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers are also able to gain unauthorized access to existing tickets...

CVE-2023-31597

An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers are also able to gain unauthorized access to existing tickets...

PT-2023-23401 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad version 5.4.0 Description: An issue in the software allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers are also able to gain unauthorized access to existin...

Sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Online Exam System 1.0. This issue affects some unknown processing of the file /jurusanmatkul/data. The manipulation of the argument columns1data leads to sql injection. The attack may be initiated remotely. The...

mysql: Server: DML unspecified vulnerability (CPU Jan 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

Sage Group Sage 300 安全漏洞

Sage Group Sage 300 is a well-established closed-source Enterprise Resource Planning ERP solution from Sage Group, UK, designed to facilitate ... A security vulnerability exists in Sage Group Sage 300. An attacker can exploit the vulnerability to recover used SQL connection strings and can create...

ClickHouse vulnerable to client certificate password exposure in client exception

Summary As initially reported in issue 1331, when client certificate authentication is enabled with password protection, the password referred to as the client option sslkey may be exposed in client exceptions e.g., ClickHouseException or SQLException. This vulnerability can potentially lead to...

The vulnerability of the Core component of the Oracle Health Sciences InForm software for clinical testing allows a hacker to gain access to data and manipulate it.

The vulnerability of the Core component of the Oracle Health Sciences InForm software for clinical testing exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to data and manipulate it using a specially craft...

The vulnerability of the Networking component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine allows attackers to manipulate data.

The vulnerability of the Networking component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine exists due to insufficient testing of input data. Exploiting this vulnerability allows a malicious actor to manipulate data remotely...

The vulnerability of the Swing component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine allows attackers to manipulate data.

The vulnerability of the Swing component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine exists due to insufficient testing of input data. Exploiting this vulnerability allows a remote attacker to manipulate data...

Vulnerability of the Server component: The DML of the MySQL Server database management system, which allows attackers to cause service interruptions.

The vulnerability of the MySQL Server component exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...