CVE-2022-35293

Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application...

Design/Logic Flaw

Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application...

CVE-2022-35293

SAP Enable Now is affected by insecure session management that allows an unauthenticated attacker to gain access to a user’s account, with possible viewing or modification of user data and limited impact on confidentiality and integrity. The connected documents confirm the issue but do not provid...

CVE-2022-35293

Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application...

CVE-2022-35293

Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application...

SAP Enable Now Manager 安全漏洞

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for online learning and training in SAP and non-SAP systems, among other things. A security vulnerability exists in SAP Enable Now Manager. No information about this...

PT-2022-4103

Name of the Vulnerable Software and Affected Versions SAP Enable Now affected versions not specified Description The issue is related to insecure session management and authorization procedure weaknesses. An unauthenticated attacker can exploit this to gain access to a user's account, potentially...

CVE-2022-36343

Authenticated author or higher user role Stored Cross-Site Scripting XSS vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin = 1.0.1 at WordPress...

WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.3 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by Kim Jong Min aka Universe Patchstack Alliance in WordPress Enable SVG, WebP & ICO Upload plugin versions = 1.0.3. Solution No patched version available...

TerraformGoat - "Vulnerable By Design" Multi Cloud Deployment Tool

TerraformGoat is selefra research lab's "Vulnerable by Design" multi cloud deployment tool. Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei Cloud, Amazon Web Services, Google Cloud Platform, Microsoft Azure. Scenarios ID | Cloud Service Company | Types Of Cloud...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to an assertion failure. Exploiting this vulnerability is only possible if the SQLite instance was compiled with -DSQLITEENABLESTAT4. PoC sql CREATE TABLE t0 c0 INT, c1 INT PRIMARY KEY WITHOUT ROWID; INSERT INT...

Microsoft Windows BitLocker 安全特征问题漏洞

Microsoft Windows BitLocker is a BitLocker by Microsoft Corporation USA Ensure secure backup of recovery keys before activating protection. Microsoft Windows BitLocker has a security feature issue. The following products and versions are affected:Windows 10 for 32-bit Systems,Windows 10 for...

DEBIAN-CVE-2022-31085

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by...

PT-2022-5116 · Unknown · Dotcms Core

Name of the Vulnerable Software and Affected Versions: dotCMS Core versions through 22.06 Description: The issue is related to a Reflected Cross-site scripting XSS problem in the admin portal of dotCMS Core. This occurs when the configuration has XSS PROTECTION ENABLED set to false. The...

CVE-2022-1562

The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2022-1562

The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

WordPress plugin Enable SVG 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Enable SVG plugin version 1.4.0 or earlier has a cross-site scripting vulnerability that...

Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic

None...

WordPress Enable SVG plugin <= 1.3.1 - Stored Cross-Site Scripting (XSS) vulnerability via SVG

Stored Cross-Site Scripting XSS vulnerability via SVG discovered by Luan Pedersini in WordPress Enable SVG plugin versions = 1.3.1. Solution Update the WordPress Enable SVG plugin to the latest available version at least 1.4.0...

RedHat pesign 代码问题漏洞

pesign is a tool for signing PE-COFF binaries, and is expected to be at least vaguely compliant with the PE and Authenticode specifications. A security vulnerability exists in pesign that stems from the inability of the cmssetpwdata function in the cmscommon.c file to handle NULL pwdata calls fro...