18641 matches found
Design/Logic Flaw
A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unauthorized code can be injected into the product's processes, potentially leading to remote control and unauthorized access to sensitive user data...
SQL Injection
hoteldruid is vulnerable to SQL Injection. The vulnerability is due to there is no sanitization of user inputs in idutentelog POST parameter. This allows an attacker to inject malicious SQL commands, and potentially leads to unauthorized data access...
SQL Injection
hoteldruid is vulnerable to SQL injection. The vulnerability is due to there is no sanitization of user inputs in numcaselle POST parameter. This allows an attacker to inject malicious SQL commands, and potentially leads to unauthorized data access...
BD FACSChorus Security Breach
BD FACSChorus is a multichannel flow cytometry system from BD Medical BD. A security vulnerability exists in the BD FACSChorus that arises from the software not properly assigning data access rights to operating system user accounts...
PT-2023-31163 · Unknown · Xmachoviewer
Name of the Vulnerable Software and Affected Versions: XMachOViewer version 0.04 Description: A dylib injection issue allows attackers to compromise integrity by injecting unauthorized code into the product's processes. This could potentially lead to remote control and unauthorized access to...
Vulnerability fixed in Solarwinds Platform
Solarwinds has fixed a vulnerability in Solarwinds Platform. A malicious party could exploit the vulnerability to use SQL-Injection to gain access to sensitive data, or potentially execute arbitrary code with application privileges. For successful exploitation, the malicious party must be...
CVE-2023-49313
A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unauthorized code can be injected into the product's processes, potentially leading to remote control and unauthorized access to sensitive user data...
OroCRMCallBundle Access Control Error Vulnerability
OroCRMCallBundle is a plugin package from Oro. An Access Control Error vulnerability exists in OroCRMCallBundle, which stems from insufficient security checks and allows an attacker to bypass the security restrictions of an Access Control List ACL to access information in any event. Affected...
PT-2023-22123 · Unknown · Facschorus
Name of the Vulnerable Software and Affected Versions: FACSChorus affected versions not specified Description: The issue concerns improper assignment of data access privileges for operating system user accounts in the FACSChorus software. This allows a non-administrative OS account to modify...
SQL Injection
hoteldruid is vulnerable to SQL injection. The vulnerability is due to there is no sanitization of user inputs in various parameters of the creaprezzi.php page in HotelDruid. This allows an attacker to inject malicious SQL commands, and potentially leads to unauthorized data access...
The vulnerability of Firefox’s Reader Mode in the iOS browser allows a hacker to gain unauthorized access to protected information and perform cross-site scripting attacks.
The vulnerability of Firefox’s Reader Mode for iOS relates to the lack of measures taken to eliminate HTML tags. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information and perform cross-site scripting attacks...
PT-2023-30718 · Unknown · Prestashop
Name of the Vulnerable Software and Affected Versions: PrestaShop opartdevis versions 4.5.18 through 4.6.12 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via a crafted script to the getModuleTranslation function. This enables the attacker to potentially...
Redirection for Contact Form 7 < 3.0.0 - Missing Authorization
Description The Redirection for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportcurrentfilteredview function hooked via admininit in versions up to, and including, 2.9.2. This makes it possible for unauthenticated...
WPvivid Backup Plugin < 0.9.91 - Missing Authorization via 'start_staging' and 'get_staging_progress'
Description The WPvivid Backup Plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startstaging' and 'getstagingprogress' functions in versions up to, and including, 0.9.90. This makes it possible for authenticated...
meshery SQL Injection Vulnerability
meshery is a software application. A multi-service grid management plane that provides lifecycle, configuration and performance management of service grids and their workloads. An SQL injection vulnerability exists in meshery versions prior to 0.6.179, which stems from the presence of a SQL...
The vulnerability of the httpd microprogramming system in TP-Link TL-WR902AC Wi-Fi routers allows a intruder to gain unauthorized access to protected information.
The vulnerability of the httpd microprogramming system in TP-Link Wi-Fi routers like the TL-WR902AC is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization via export_settings
Description The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the exportsettings function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with...
Ultimate Addons for Contact Form 7 < 3.2.11 - Missing Authorization
Description The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the uacf7databaseexportcsv function hooked via init in versions up to, and including, 3.2.10. This makes it possible for unauthenticated...
UserPro < 5.1.5 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template
Description The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userproshortcodetemplate' function in versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to arbitrary shortcode execution. An...
Vulnerabilities fixed in Mozilla Firefox and Thunderbird
Mozilla has fixed vulnerabilities in Firefox and Thunderbird. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS. Remote code execution User Rights Spoofing Access to system data Successful...