PT-2022-26856 · Telenia Software S.R.L · Tvox

Name of the Vulnerable Software and Affected Versions: Telenia Software s.r.l TVox versions prior to 22.0.17 Description: The issue is related to a remote code execution RCE vulnerability found in the component action export control.php. Recommendations: For versions prior to 22.0.17, update to...

CVE-2022-37017: Undefined Security Weakness

Symantec Endpoint Protection Windows agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing security controls. This CVE applies narrowly to the Client User...

CVE-2022-38803

Zkteco BioTime 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can read local files by exploiting XSS into a pdf generator when exporting data as a PDF...

CVE-2022-38802

Zkteco BioTime 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by exploiting XSS into a pdf generator when exporting data as a PDF...

Zkteco BioTime cross-site scripting vulnerability

Zkteco BioTime is a powerful web-based time and attendance management software from the Chinese company Zkteco. A security vulnerability exists in Zkteco BioTime versions prior to 8.5.4, which stems from susceptibility to incorrect access control, where an authenticated employee can read a local...

CVE-2022-38802

Zkteco BioTime 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by exploiting XSS into a pdf generator when exporting data as a PDF...

CVE-2022-38802

Zkteco BioTime 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by exploiting XSS into a pdf generator when exporting data as a PDF...

Zkteco BioTime cross-site scripting vulnerability

Zkteco BioTime is a powerful web-based time and attendance management software from the Chinese company Zkteco. A security vulnerability exists in Zkteco BioTime versions prior to 8.5.4, which stems from vulnerability to incorrect access control, where an authenticated administrator can read a...

CVE-2022-38803

The CVE-2022-38803 issue affects Zkteco BioTime prior to 8.5.3 Build 20200816.447. Root cause: Incorrect Access Control allowing an authenticated user to cause cross-site scripting in the PDF export generator, enabling reading of local files when exporting data as a PDF. Impact: confidentiality o...

PT-2022-24576 · Zkteco · Zkteco Biotime

Name of the Vulnerable Software and Affected Versions: Zkteco BioTime versions prior to 8.5.3 Build:20200816.447 Description: The issue concerns Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can exploit XSS into a pdf generator when exporting data as a PDF to...

PT-2022-25353 · WordPress · Appointment Hour Booking Plugin

Name of the Vulnerable Software and Affected Versions: Appointment Hour Booking Plugin for WordPress versions up to, and including, 1.3.72 Description: The issue allows unauthenticated attackers to embed untrusted input into content during booking creation, which may be exported as a CSV file whe...

WP CSV Exporter < 1.3.7 - CSV Injection

The plugin does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability. - create a post using =5+5 as the title - export the data as CSV - open the CSV with a spreadsheet application Excel, Libre Office - the CSV formula gets executed...

Johnlong software Raiden MAILD Mail Server security vulnerability

Team Johnlong software Raiden MAILD Mail Server is a mail server software from Team Johnlong software. A security vulnerability exists in Team Johnlong software Raiden MAILD Mail Server versions prior to v4.7.4. The vulnerability originates from the fact that a remote attacker with general user...

CVE-2022-3603

The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection...

CVE-2022-3603

The CVE-2022-3603 issue affects the WordPress plugin “Export customers list csv for WooCommerce” (and related WordPress export functionality). The vulnerability is due to lack of data validation when outputting data back into a CSV file, enabling CSV injection. Affected versions are prior to 2.0....

CVE-2022-3603 Export customers list CSV for WooCommerce < 2.0.69 - CSV Injection

The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection...

CVE-2022-3603: Undefined Security Weakness

The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection...

PT-2022-22577 · WordPress · Awesome Support

Name of the Vulnerable Software and Affected Versions: Awesome Support WordPress plugin versions prior to 6.1.2 Description: The issue allows a low-privileged user, such as a subscriber, to download arbitrary exported tickets via an IDOR vector. This occurs because the plugin does not ensure that...

WordPress plugin "Find and Replace All" – Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

PT-2022-23127 · Woocommerce +1 · Export Customers List Csv For Woocommerce +2

Name of the Vulnerable Software and Affected Versions: Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin versions prior to 2.0.69 Description: The issue concerns a lack of data validation when outputting data back into a CSV file,...