Cross-site Request Forgery (CSRF)

rdiffweb is vulnerable to cross-site request forgery. The vulnerability exists in renderprefspanel function in prefnotification.py because the server accepts the GET request that is sent to modify repository notifications settings which allows an attacker to disable the notifications sent to user...

PT-2022-25388 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2022 Description: An absolute path traversal issue allows attackers to obtain sensitive information via a crafted GET request sent to "/one/siteinfo.php". Recommendations: For ZZCMS version 2022, as a temporary workaround,...

Google KFM Cross-Site Script Vulnerability

Google KFM is an ajax file browser and manager from Google, Inc. A security vulnerability exists in Google KFM that stems from a cross-site scripting XSS vulnerability that can be triggered via a crafted GET request to /kfm/index.php...

ZZCMS path traversal vulnerability

ZZCMS is a content management system CMS from the ZZCMS team in China. A security vulnerability exists in ZZCMS 2022, which stems from a vulnerability that allows an attacker to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php...

CVE-2022-40443: Improper Limitation of a Pathname to a Restricted Directory

An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php...

Cross-site Request Forgery (CSRF)

rdiffweb is vulnerable to cross-site request forgery. The vulnerability exists in repository and user deletions because the server accepts the GET request for deleting repositories and users which allows an attacker to cause a CSRF attack...

Fortinet FortiSOAR Code Injection Vulnerability

Fortinet FortiSOAR is a security orchestration, automation, and response SOAR solution from Fortinet USA. A code injection vulnerability exists in Fortinet FortiSOAR that stems from incorrect neutralization of a particular element used and can be exploited by an authenticated attacker to execute...

CVE-2022-29061

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests...

Fortinet FortiSOAR operating system command injection vulnerability

Fortinet FortiSOAR is a security orchestration, automation, and response SOAR solution from Fortinet USA. A code injection vulnerability exists in Fortinet FortiSOAR that stems from incorrect neutralization of a particular element used and can be exploited by an authenticated attacker to execute...

CVE-2022-27967

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via a crafted GET request sent to /WebApp/SettingsExclusion/GetExclusionsProfiles...

CVE-2022-27967

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via a crafted GET request sent to /WebApp/SettingsExclusion/GetExclusionsProfiles...

Design/Logic Flaw

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via a crafted GET request sent to /WebApp/SettingsExclusion/GetExclusionsProfiles...

Design/Logic Flaw

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of decoy users via a crafted GET request sent to /WebApp/DeceptionUser/GetAllDeceptionUsers...

CVE-2022-27968

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of monitored files and profiles via a crafted GET request sent to /WebApp/SettingsFileMonitor/GetFileMonitorProfiles...

CVE-2022-27969: Undefined Security Weakness

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of decoy users via a crafted GET request sent to /WebApp/DeceptionUser/GetAllDeceptionUsers...

CVE-2022-27967: Undefined Security Weakness

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via a crafted GET request sent to /WebApp/SettingsExclusion/GetExclusionsProfiles...

CVE-2022-27968: Undefined Security Weakness

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of monitored files and profiles via a crafted GET request sent to /WebApp/SettingsFileMonitor/GetFileMonitorProfiles...

CVE-2022-36552

Tenda AC6AC1200 v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request...

CVE-2022-36552

Tenda AC6AC1200 v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request...

Input validation

Tenda AC6AC1200 v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request...