PT-2023-14689

Name of the Vulnerable Software and Affected Versions Future-Depth Institutional Management Website IMS version 1.0 Description The issue allows attackers to execute arbitrary commands via the ad parameter to "/admin area/login transfer.php" API endpoint. This enables attackers to potentially...

CVE-2022-45786 Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection

There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition t...

CVE-2022-32748

A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...

CVE-2022-32748

CVE-2022-32748 affects EcoStruxure™ Cybersecurity Admin Expert (CAE) versions prior to 2.2. Root cause: CWE-295 Improper Certificate Validation, which can cause CAE to present or process incorrect data to end users and may enable credential leakage, allowing an attacker to log into the configurat...

E-Business Collections Oracle Demantra Demand Management Fraud Manipulation

The vulnerability of the E-Business Collections component of the Oracle Demantra Demand Management demand management platform is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to manipulate data remotely...

Oracle E-Business Suite Setup Sub-component Data Manipulation

The vulnerability of the Setup sub-component of the Oracle Learning Management component in the Oracle E-Business Suite system relates to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to manipulate data remotely...

Automated Test Suite Oracle HCM Common Architecture Manipulation

The vulnerability of the sub-component of the Automated Test Suite of the Oracle HCM Common Architecture in the Oracle E-Business Suite system relates to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to manipulate data remotely...

hazelcast: Hazelcast connection caching

A flaw was found in Hazelcast and Hazelcast Jet. This flaw may allow an attacker unauthenticated access to manipulate data in the cluster...

PT-2023-16291 · Tenable · Tenable.Sc

Name of the Vulnerable Software and Affected Versions: Tenable.sc affected versions not specified Description: A LDAP injection issue exists due to improper validation of user-supplied input. An authenticated attacker could generate data in Active Directory using the application account through...

IDOR vulnerability allowing to update another user's annotations

Description IDOR vulnerability was discovered in wallabag. Proof of Concept 1. Login as a victim. 2. Create an entry and an annotation. In this case the annotation's ID is 3. 3. Login as an attacker. 4. Send the following request. request http PUT /annotations/3 HTTP/1.1 Host: localhost:8000...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

Crlf injection

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

CVE-2022-36437

A flaw was found in Hazelcast and Hazelcast Jet. This flaw may allow an attacker unauthenticated access to manipulate data in the cluster...

CVE-2023-21844

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

Code injection

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

Oracle Java SE Security Update (jan2023) 02 - Windows

Oracle Java SE is prone to an input validation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Java SE Security Update (jan2023) 03 - Windows

Oracle Java SE is prone to an input validation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

CVE-2023-21891

Oracle BI Enterprise Edition (Oracle Fusion Middleware) Visual Analyzer contains an input-validation flaw that allows a low-privileged, network-facing attacker to access or modify data via HTTP. Affected versions are 5.9.0.0.0 through 6.4.0.0.0; successful attempts may update/insert/delete data a...