CVE-2022-1461

Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1...

CVE-2022-1461 Non Privilege User can Enable or Disable Registered in openemr/openemr

Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1...

OpenEMR安全漏洞

OpenEMR is an open source medical management system from the Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing requests. A security vulnerability exists in versions of OpenEMR prior to 6.1.0.1 that stem...

IgniteUp <= 3.4.1 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some fields when high privilege users don't have the unfilteredhtml capability, which could lead to Stored Cross-Site Scripting issues PoC Customise a template from the plugin /wp-admin/admin.php?page=cscstemplates and put the following payload in the...

firefox security update

91.8.0-1.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Enabled aarch64 build 91.8.0-1 - Update to 91.8.0...

CVE-2022-1155

Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...

CVE-2022-1155 Old sessions are not blocked by the login enable function. in snipe/snipe-it

Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...

CVE-2022-0680

The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plzconfigurationtrackerenable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue...

WordPress plugin Social Sharing Plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the...

Old sessions are not blocked by the login enable function.

Description If you disable logic function of an user, that user can still login by using their old session. Proof of Concept Step 1: login to dashboard by a normal account. Step 2: use a diffrent browser to login as admin Step 3: make the normal account in step 1 unable to login. Step 4: return t...

Nextcloud: Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic

Summary: add summary of the vulnerability Steps To Reproduce: 1. Create a Call as User A Moderator 2. Add User B to the call 3. Start the call as User A 4. User B joins the call and enables the camera 5. User A removes all permissions for User B, cam and mic are now disabled 6. User A grants all...

CVE-2022-1003

One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads...

Internet Bug Bounty: Use of uninitialized value of in req_parsebody method of lua_request.c

Software Versions Ubuntu - 18.04 64-bit Apache 2.4.51 - 64 bit Cause of Bug This bug is present in the reqparsebody method of luarequest.c file. Below mentioned lines of code cause this bug. cpp const char data; int i; sizet vlen = 0; sizet len = 0; if luareadbodyr, &data, aprofft &size,...

CVE-2022-25816

Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable without authentication...

CVE-2022-25816

Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable without authentication...

Samsung Lock and mask apps setting 授权问题漏洞

Samsung Lock and mask apps setting is a secure application from Samsung South Korea. It is used to block apps or lock apps. A security vulnerability exists in Samsung Lock and mask apps setting that allows an attacker to change the enable/disable settings without authentication...

GSD-2022-1000503 arm64: dts: meson-sm1-odroid: use correct enable-gpio pin for tf-io regulator

arm64: dts: meson-sm1-odroid: use correct enable-gpio pin for tf-io regulator This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.10 by commit...

GSD-2022-1000425 arm64: dts: meson-sm1-odroid: use correct enable-gpio pin for tf-io regulator

arm64: dts: meson-sm1-odroid: use correct enable-gpio pin for tf-io regulator This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.24 by commit...

D-Link Dir-823-Pro Command Injection Vulnerability (CNVD-2022-15177)

D-Link Dir-823-Pro is a dual-band smart wireless router from China Youxun D-Link. D-Link DIR-823-Pro v1.0.2 contains a command injection vulnerability, which can be exploited by attackers to execute arbitrary commands via the stationaccessenable parameter...

GSD-2022-1000249 usb: xhci-plat: fix crash when suspend if remote wake enable

usb: xhci-plat: fix crash when suspend if remote wake enable This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.19 by commit...