SQL Injection Vulnerability in Car Rental Management System

Car Rental Management System is a car rental management system. SQL injection vulnerability exists in Car Rental Management System, which can be exploited by attackers to view, add, modify or delete information in the back-end database...

GHSA-MHVF-J94G-3QP7 Magento 2 Community Edition CSRF vulnerability

A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unintended data deletion from customer pages...

Magento 2 Community Edition CSRF vulnerability

A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unintended data deletion from customer pages...

Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX Calls

The plugin does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as...

Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX Calls

The plugin does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as...

Authentication flaw

Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01, HMI GC-A2 seriesGC-A22W-CW, GC-A24W-CW, GC-A26W-CW, GC-A24, GC-A24-M, GC-A25, GC-A26, and GC-A26-J2, and Real time remote monitoring and contr...

PT-2022-19674 · Unknown +1 · Hmi Gc-A2 Series +2

Name of the Vulnerable Software and Affected Versions: Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01 HMI GC-A2 series versions including GC-A22W-CW, GC-A24W-CW, GC-A26W-CW, GC-A24, GC-A24-M, GC-A25, GC-A26, and GC-A26-J2 Real time remote monitoring and control tool Remote GC...

Cybozu Garoon Authorization Issue Vulnerability (CNVD-2022-54302)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. Cybozu Garoon suffers from an authorization issue vulnerability that originates from improper privilege managemen...

Cybozu Garoon security vulnerability

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. Cybozu Garoon suffers from an authorization issue vulnerability that originates from improper privilege managemen...

CVE-2022-22798

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp...

CVE-2022-29610

SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete theme data, which could result in Stored Cross-Site Scripting XSS attack...

CVE-2022-29610: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete theme data, which could result in Stored Cross-Site Scripting XSS attack...

CVE-2022-21449

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows...

Oracle MySQL Input Validation Error Vulnerability (CNVD-2022-52562)

Oracle MySQL Server is a relational database from Oracle Corporation USA. MySQL Server is vulnerable due to an input validation error in the Server:Optimizer component of MySQL Server. A remote authenticated attacker could exploit this vulnerability to corrupt or delete data...

CVE-2020-25163

A remote attacker with write access to PI ProcessBook files could inject code that is imported into OSIsoft PI Vision 2020 versions prior to 3.5.0. Unauthorized information disclosure, modification, or deletion is also possible if a victim views or interacts with the infected display. This...

PT-2022-8705

Name of the Vulnerable Software and Affected Versions OSIsoft PI Vision 2020 versions prior to 3.5.0 Description A remote attacker with write access to PI ProcessBook files could inject code that is imported into OSIsoft PI Vision. Unauthorized information disclosure, modification, or deletion is...

CVE-2020-25163: Improper Neutralization of Input During Web Page Generation

A remote attacker with write access to PI ProcessBook files could inject code that is imported into OSIsoft PI Vision 2020 versions prior to 3.5.0. Unauthorized information disclosure, modification, or deletion is also possible if a victim views or interacts with the infected display. This...

Oracle Communications Operations Monitor Mediation Engine Privilege Escalation

The vulnerability of the Mediation Engine component of the Oracle Communications Operations Monitor visualization and monitoring system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to gain read access to data, modify, add, or delet...

Mediation Engine Privilege Escalation

The vulnerability of the Mediation Engine component of the Oracle Communications Operations Monitor visualization and monitoring system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to data o...

Oracle WebLogic Server Unauthorized Access

The vulnerability of the Core server component of Oracle WebLogic Server is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to read, modify, or delete data, or to cause a service failure using t...