4062 matches found
Insecure Direct Object References when creating a list
Description Insecure direct object references when creating a list allows one user to create a new list on behalf of another. Proof of Concept POST /list HTTP/2 Host: bookwyrm.social Cookie: djangolanguage=None; csrftoken=I5lj4znBJ9B5HnT3FAsII67G1EISidIKGlsIz5ElN9kmlDwucM2hGKx0Fy4gM8vj;...
Vulnerabilities fixed in Juniper Junos Space
Vulnerabilities have been fixed in Junos Space Platform. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Bypassing authentication Accessing sensitive data Accessing syste...
Vulnerabilities fixed in Juniper products
Juniper has fixed vulnerabilities in several products. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution User rights...
Vulnerabilities fixed in Siemens products
Vulnerabilities have been fixed in several Siemens products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Bypassing authentication Circumvention of security measure...
Vulnerability fixed in rsyslog
The developers of rsyslog have fixed a vulnerability in rsyslog. A malicious party could exploit the vulnerability to cause a denial-of-service, or to potentially manipulate data manipulate and thus potentially inject false information into the central syslog environment. The developers do not ru...
Vulnerabilities fixed in Cisco products
Vulnerabilities have been fixed in several Cisco products. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Circumvention of security measure Remote code execution Use...
Radancy: Admin account/panel takeOver and Doing actions in admin panel via DOM-based XSS
Hello team , I found Dom-XSS in your https://████████/ Webmail Admin Panel that manage attacker to stealing admin sensitive info and doing any action in your webmail admin panel . why and how this vulnerability happen : - if your reviewed the source code of this endpoint of the admin panel "...
CVE-2017-20110
A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown functionality of the component Administration. The manipulation as part of JSON leads to information disclosure Credentials. The attack may be launched remotely...
Denial Of Service (DoS)
systemds is vulnerable to denial of service. The vulnerability exists because the readExternal function of DecoderComposite.java does not properly check the number of deserialized decoders in the DecoderComposite object, allowing an attacker to crash the application by providing a large size of...
CVE-2022-1521
CVE-2022-1521 affects Illumina Local Run Manager (LRM) software versions 1.3–3.1 used on various Illumina instruments. The root cause is that LRM does not implement authentication or authorization by default, allowing an unauthenticated, network-facing attacker to inject, replay, modify, or inter...
CVE-2022-1521 3.2.4 IMPROPER ACCESS CONTROL CWE-284
LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data...
PT-2022-11345
Name of the Vulnerable Software and Affected Versions LaiKetui version 3.5.0 Description A SQL injection issue exists in the background administrator list, which could potentially allow unauthorized access or data manipulation. Recommendations For LaiKetui version 3.5.0, at the moment, there is n...
Vulnerabilities fixed in Dell SupportAssistant
Vulnerabilities have been fixed in Dell SupportAssist. The vulnerabilities allow a malicious party to launch attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Remote code execution User Rights Access to system data Increased...
JTEKT TOYOPUC Products 访问控制错误漏洞
JTEKT TOYOPUC Products is a family of programmable controllers from JTEKT Japan. An access control error vulnerability exists in JTEKT TOYOPUC Products that stems from a lack of authentication functionality in the affected products. An attacker could use this vulnerability to change the controlle...
PT-2022-11418
Name of the Vulnerable Software and Affected Versions NOKIA VitalSuite SPM version 2020 Description The issue is related to SQL injection through the UserName variable. This allows for potential unauthorized access or manipulation of data. Recommendations For NOKIA VitalSuite SPM version 2020,...
PT-2022-21256
Name of the Vulnerable Software and Affected Versions Product Show Room Site version 1.0 Description The issue concerns SQL Injection via the "/psrs/admin/categories/manage field order.php?id=" API endpoint, where the id variable is vulnerable. This allows for potential unauthorized access and...
PT-2022-21266
Name of the Vulnerable Software and Affected Versions Product Show Room Site version 1.0 Description The issue concerns SQL Injection via the /psrs/admin/?page=inquiries/view inquiry&id= endpoint. This allows for potential data manipulation. No information is provided about the estimated number o...
Security Updates for Microsoft Office Products C2R (January 2020)
The Microsoft Office Products are missing a security update. It is, therefore, affected by the following vulnerability: - A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited...
Vulnerability fixed in Fortinet products
Vulnerabilities have been fixed in several products from Fortinet. The vulnerabilities allow a malicious party to execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Circumvention of security measure Remote code execution...
PT-2022-21050
Name of the Vulnerable Software and Affected Versions Car Rental Management System version 1.0 Description The issue concerns SQL Injection via the /ip/car-rental-management-system/admin/ajax.php?action=login API endpoint. This allows for potential unauthorized access and data manipulation. No...