13348 matches found
CVE-2022-33882
CVE-2022-33882 affects Autodesk Desktop App (ADA). Multiple sources describe a vulnerability in ADA’s file-delete/update handling that can be exploited to create an unintended sphere of control, enabling privilege escalation and execution of arbitrary code. ZDI advisories frame this as a local pr...
CVE-2022-42002
SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutations can be called without any authentication to overwrite any files on a SonicJS application, leading to Arbitrary File Write and Delete...
Authentication flaw
SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutations can be called without any authentication to overwrite any files on a SonicJS application, leading to Arbitrary File Write and Delete...
SonicJS 缓冲区错误漏洞
SonicJS is a content management system based on modern open source NodeJs by Lane Personal Developer. A buffer error vulnerability exists in SonicJS version 0.6.0 and prior versions, which stems from a file overwrite. An attacker exploiting this vulnerability can write and delete arbitrary files...
CVE-2022-42002
CVE-2022-42002 affects SonicJS up to version 0.6.0. The vulnerability stems from unauthenticated access to the file mutation mutations, specifically fileCreate and fileUpdate , which can overwrite arbitrary files on a SonicJS application. This leads to Arbitrary File Write and Delete . Connection...
CVE-2022-42002
SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutations can be called without any authentication to overwrite any files on a SonicJS application, leading to Arbitrary File Write and Delete...
WordPress Contact Bank plugin <= 3.0.30 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Zhang Yunpei in WordPress Contact Bank plugin versions = 3.0.30. Solution Deactivate and delete. This plugin has been closed as of September 28, 2022 and is not available for download. This closure is temporary, pending a...
CVE-2022-39033
Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete...
Authorization
mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to stea...
CVE-2022-40926
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leavesystem/classes/Master.php?f=deleteleavetype...
CVE-2022-40927
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leavesystem/classes/Master.php?f=deletedesignation...
CVE-2022-2405
The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup...
Sql injection
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leavesystem/classes/Master.php?f=deleteleavetype...
CVE-2022-40926
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leavesystem/classes/Master.php?f=deleteleavetype...
Security Bulletin: Multiple vulnerabilities in IBM Infosphere Optim Data Growth for Oracle E-Business Suite (CVE-2013-0577, CVE-2013-0579, CVE-2013-0580)
Abstract Multiple vulnerabilities exist in the Optim E-Business Console that can allow an attacker to view sensitive information, perform actions as an impersonated legitimate user, or upload, modify or delete web pages or scripts on the server. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-057...
PT-2022-25626 · Unknown · Online Leave Management System
Name of the Vulnerable Software and Affected Versions: Online Leave Management System version 1.0 Description: The issue concerns a SQL Injection vulnerability via the "/leave system/classes/Master.php?f=delete application" API endpoint. This allows for potential unauthorized access and...
Online Leave Management System SQL注入漏洞
Online Leave Management System is an online leave management system. SQL injection vulnerability exists in Online Leave Management System v1.0, which originates from /leavesystem/classes/Master.php?f=delete leavetype lacks validation for external input SQL statements. An attacker could use this...
PT-2022-25625 · Unknown · Online Leave Management System
Name of the Vulnerable Software and Affected Versions: Online Leave Management System version 1.0 Description: The issue concerns a SQL Injection vulnerability via the "/leave system/classes/Master.php?f=delete designation" API endpoint. This allows for potential unauthorized access and...
Security Bulletin: Vulnerability in command line interface (CVE-2013-5455)
Abstract Any user, even with READ-ONLY access to everything, has the ability to start/stop/DELETE ANY virtual system using the command line interface. Content VULNERABILITY DETAILS: DESCRIPTION: Any user, even with READ-ONLY access to everything, has the ability to start/stop/DELETE ANY virtual...