Sql injection

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list...

AirDisk 7.5.5 Cross Site Scripting

Exploit Title: AirDisk 7.5.5 File Manager Stored XSS Date: Sep 8, 2022 Exploit Author: Chokri Hammedi Vendor Homepage: https://apps.apple.com/us/developer/felix-yew/id505904424 Software Link: https://apps.apple.com/us/app/airdisk-file-manager/id566530748 Version: 7.5.5 Tested on: iPhone ios 15.6 ...

Download Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path Traversal

The plugin does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory 1. Navigate to settings page /wp-admin/edit.php?posttype=wpdmpro&page=settings 2. In the “File Browser Root:” setting,...

PT-2022-4663 · Trend Micro · Trend Micro Housecall

Name of the Vulnerable Software and Affected Versions: Trend Micro HouseCall versions 1.62.1.1133 and below Description: The issue is related to incorrect permission assignment, which could allow a local attacker to escalate privileges due to an overly permissive folder in the product installer...

org.jenkins-ci.plugins:github-branch-source (>=0.1-beta-1, <=1.10.1), org.jenkins-ci.plugins:github-organization-folder (>=1.0-beta-1, <=1.5) +2 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.3)

org.jenkins-ci.plugins:git MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source =0.1-beta-1, =1.0-beta-1, =1.0, =1.0.0, =1.0.3 Source cves:...

org.jenkins-ci.plugins:github-branch-source (2.0.0-beta-1), org.jenkins-ci.plugins:github-organization-folder (1.6-beta-1) +1 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.6.2-beta-1)

org.jenkins-ci.plugins:git MAVEN version 2.6.2-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source 2.0.0-beta-1 -...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.0-beta-1), org.jenkins-ci.plugins:github-branch-source (2.0.0-beta-2) +1 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.6.2-beta-2)

org.jenkins-ci.plugins:git MAVEN version 2.6.2-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.0-beta-1 -...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.0.0, <=2.0.2-beta-1), org.jenkins-ci.plugins:github-branch-source (>=2.0.0, <=2.0.1-beta-6) +1 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.6.2)

org.jenkins-ci.plugins:git MAVEN version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source =2.0.0, =2.0.0, =2.0.1-beta-6 -...

CVE-2022-31262

An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as...

Privilege escalation

An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as...

CVE-2022-31262

An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as...

CVE-2022-31262

An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as...

Reduce logon time with Profile Management

Profile Management provides various features to improve logon performance. Examples are Profile streaming, Enable profile streaming for folders, Accelerate folder mirroring, Enable the Profile container for the entire user profile, and more. These features are helpful in scenarios where profiles...

GOG Galaxy security vulnerabilities

GOG Galaxy is a game client program from the Polish company GOG. The program is used to install, launch and update games. A security vulnerability exists in GOG Galaxy version 2.0.46, which stems from the presence of an exploitable local lifting vulnerability that, due to insufficient folder...

PT-2022-20650 · Gog · Gog Galaxy

Name of the Vulnerable Software and Affected Versions: GOG Galaxy versions 2.0.46 through 2.0.51 Description: An exploitable local privilege escalation issue exists due to insufficient folder permissions. An attacker can hijack the %ProgramData%GOG.com folder structure and change the...

Emerson Proficy Machine Edition code-related vulnerabilities

Emerson Proficy Machine Edition is a software application from Emerson Electric USA, Inc. An automation solution. A code issue vulnerability exists in Emerson Proficy Machine Edition 9.00 and prior versions that originates from uploading any file written to the PLC logical folder to a connected P...

PT-2022-4364 · Ge Digital · Proficy Machine Edition

Name of the Vulnerable Software and Affected Versions: Proficy Machine Edition versions 9.00 and prior Description: The issue is related to an unrestricted upload of files with dangerous types. This allows an attacker to upload and execute malicious files in the target system. The vulnerability i...

CVE-2020-21641

Out-of-Band XML External Entity OOB-XXE vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file...

CVE-2020-21641: Improper Restriction of XML External Entity Reference

Out-of-Band XML External Entity OOB-XXE vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file...

ZOHO ManageEngine Analytics Plus code-related vulnerabilities

ZOHO ManageEngine Analytics Plus is a self-service IT analytics solution from ZOHO India. Get a better view of your IT data with rich visualizations and dashboards. A security vulnerability exists in ZOHO ManageEngine Analytics Plus versions prior to 4.3.5. A remote attacker can exploit the...