CVE-2022-42973

Schneider Electric APC Easy UPS Online Monitoring Software (and APC Easy UPS Online Monitoring Software) versions prior to V2.5-GA, V2.5-GA-01-22261, V2.5-GS, or GS-01-22261 are affected by CVE-2022-42973 (CWE-798): use of hard-coded credentials in the database, enabling local privilege escalatio...

Schneider Electric Easy UPS Online Monitoring Software 信任管理问题漏洞

Schneider Electric Easy UPS Online Monitoring Software is a power monitoring software from Schneider Electric France. Schneider Electric Easy UPS Online Monitoring Software suffers from a trust management issue vulnerability that stems from a use of hard-coded credentials vulnerability that could...

Schneider Electric Easy UPS Online Monitoring Software 访问控制错误漏洞

Schneider Electric Easy UPS Online Monitoring Software is a power monitoring software from the French company Schneider Electric. Schneider Electric Easy UPS Online Monitoring Software suffers from an Access Control Error vulnerability that stems from a lack of authentication for critical functio...

CVE-2022-42970

A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows...

Schneider Electric Easy UPS Online Monitoring Software 代码问题漏洞

Schneider Electric Easy UPS Online Monitoring Software is a power monitoring software from Schneider Electric, a French company. A code issue exists in Schneider Electric Easy UPS Online Monitoring Software that stems from an Unlimited Uploads of Dangerous Types of Files vulnerability that could...

CVE-2022-42970

Schneider Electric APC Easy UPS Online Monitoring Software (Schneider Electric/APC Easy UPS Online Monitoring Software) versions prior to V2.5-GA (Windows 7/10/11 and Windows Server 2016/2019/2022) and prior to V2.5-GA-01-22261 (Windows 11/Server 2019/2022) are affected by CVE-2022-42970 due to m...

CVE-2022-42971

The CVE-2022-42971 issue is a real, concrete vulnerability in Schneider Electric APC Easy UPS Online Monitoring Software (and related Schneider Electric variants) where UpLoadAction.execute allows Unrestricted Upload of File with Dangerous Type. An unauthenticated attacker can upload a malicious ...

CVE-2022-42971

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to...

CVE-2022-42970

A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software Windows 7, 10, 11 & Windows...

PT-2023-15596 · Unknown · Easy Images

Name of the Vulnerable Software and Affected Versions: Easy Images version 2.0 Description: The issue allows for an arbitrary file download via the /application/down.php component. It is exploited through a crafted GET request. Recommendations: For Easy Images version 2.0, consider restricting...

CVE-2022-48161

CVE-2022-48161 affects Easy Images v2.0. An arbitrary file download vulnerability exists in the component /application/down.php, exploitable via a crafted GET request. The issue is mapped with CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base score 7.5, HIGH; network vector, no privileges, no ...

CVE-2022-48161

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request...

WordPress Easy Digital Downloads Plugin < 3.1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Easy Digital Downloads Type Plugin Vulnerable versions 3.1.0.5 Fixed in 3.1.0.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0380 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 553ace90a817 Credits István...

CVE-2022-48161

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request...

Easy Digital Downloads < 3.1.0.5 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC Add the "EDD Buy Button" Gutenberg block to a post...

Easy Digital Downloads < 3.1.0.5 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Add the "EDD Buy Button" Gutenberg block to a post and...

Easy Social Box < 4.1.3 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC easy-fb-like-box locale='"; alert1; var...

WordPress Easy Social Box / Page Plugin Plugin <= 4.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Easy Social Box / Page Plugin Type Plugin Vulnerable versions = 4.1.2 Fixed in 4.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4754 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 16d4bede1269 Credits Istv...

WordPress Easy Affiliate Links Plugin < 3.7.1 is vulnerable to Cross Site Scripting (XSS)

Software Easy Affiliate Links Type Plugin Vulnerable versions 3.7.1 Fixed in 3.7.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0375 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6cffde070434 Credits István Márton...

CVE-2023-24098

TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formSysLog. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products...