13404 matches found
GE Digital Proficy Historian 安全漏洞
GE Digital Proficy Historian is a powerful tool with storage analysis and data collection capabilities from GE Digital. A security vulnerability exists in Proficy Historian v7.0 and prior versions that originates from the possibility that an unauthorized user could delete any file on the system...
CVE-2022-45924
An issue was discovered in OpenText Content Suite Platform 22.1 16.2.19.1803. The endpoint itemtemplate.createtemplate2 allows a low-privilege user to delete arbitrary files on the server's local filesystem...
PT-2023-16234 · WordPress · Custom 404 Pro
Name of the Vulnerable Software and Affected Versions: Custom 404 Pro plugin for WordPress versions up to, and including, 3.7.1 Description: The issue is due to missing or incorrect nonce validation on the custom 404 pro admin init function, making it possible for unauthenticated attackers to...
GSD-2023-1000065 ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference
ipv4: Handle attempt to delete multipath route when fibinfo contains an nh reference This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.12 by...
Reflected XSS - Accounting Module - Maintenance - Delete Accounting Records
Description A reflected cross-site scripting XSS vulnerability exists within acct-maintenance-delete.php, which allows a malicious user to execute arbitrary JavaScript code. The vulnerable parameters are username, startdate, and enddate. Proof of Concept 1. Navigate to /acct-maintenance-delete.ph...
PT-2023-1154 · Ge · Proficy Historian
Name of the Vulnerable Software and Affected Versions: GE Proficy Historian affected versions not specified Description: The issue is related to the implementation of the MSO protocol in the GE Proficy Historian platform, which allows for unlimited upload of dangerous file types. This could enabl...
CVE-2022-4309
The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack...
PT-2023-14306
Name of the Vulnerable Software and Affected Versions Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0 Description An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast messag...
PT-2023-7515 · Tp Link · Tp-Link Archer Vr1600V
Name of the Vulnerable Software and Affected Versions: TP-Link Archer VR1600V versions = 0.1.0, 0.9.1 v5006.0 Build 220518 Rel.32480n Description: A command injection issue exists in the administrative web portal of TP-Link Archer VR1600V devices. This allows remote attackers, authenticated as...
CVE-2023-22471 Nextcloud Deck vulnerable to authorization bypass
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is...
PT-2023-18523 · Nextcloud · Nextcloud Deck
Name of the Vulnerable Software and Affected Versions: Nextcloud Deck app versions prior to 1.6.5 Nextcloud Deck app versions prior to 1.7.3 Nextcloud Deck app versions prior to 1.8.2 Description: The issue is related to broken access control, allowing a user to delete attachments of other users...
CVE-2022-46952
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=deleteuser...
CVE-2022-46951
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=deleteuploads...
CVE-2022-46950
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=deletewindow...
CVE-2022-46947
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletecategory...
CVE-2022-46946
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletebrand...
CVE-2022-46949
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletehelmet...
Sql injection
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=deletetransaction...