17638 matches found
German Authorities Warn Against Using Kaspersky Products
By Waqas The Federal Office for Information Security in Germany has urged users to uninstall any Kaspersky product from their… This is a post from HackRead.com Read the original post: German Authorities Warn Against Using Kaspersky Products...
CVE-2022-0430
CVE-2022-0430 affects HTTPie up to version 3.0.x (prior to 3.1.0). The root cause is that before 3.1.0, HTTPie’s session handling did not distinguish between cookies and their hosts, allowing cookies to be exposed during redirects to third-party sites. This led to exposure of sensitive informatio...
CVE-2022-22353
CVE-2022-22353 affects IBM Big SQL on IBM Cloud Pak for Data (versions 7.1.1; 7.2.0–7.2.3) where a authenticated user with appropriate privileges can bypass data masking rules via CREATE TABLE AS/SELECT, resulting in leakage of sensitive data. The IBM Security Bulletin notes a software defect: da...
CVE-2022-26500
creationtimestamp| type| source ---|---|--- 2022-03-14 13:38:49+00:00| seen| https://t.me/ptswarm/115 2022-03-15 17:19:30+00:00| seen| https://t.me/cKure/9039 2022-03-16 14:51:00+00:00| exploited| https://t.me/itsecnews/315 2022-03-17 23:21:50+00:00| seen| https://t.me/cibsecurity/39170 2023-06-1...
Student Grading System v1.0 SQL Injection Vulnerability
Title: Student Grading System v1.0 SQLi Author: nu11secur1ty Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/14522/student-grading-system-using-phpmysql-source-code.html Reference:...
CVE-2021-32473
CVE-2021-32473 affects Moodle releases from 3.5 up to 3.10.3, 3.9 up to 3.9.6, 3.8 up to 3.8.8, and earlier unsupported versions. The issue is an information disclosure where a student can view their quiz grade via the quiz web service before the grade is officially released. The provided documen...
CVE-2020-36518
CVE-2020-36518 affects jackson-databind prior to 2.13.0, enabling a Java StackOverflow and DoS via excessive nesting depth. In affected advisories, remediation is to upgrade jackson-databind to 2.13.0+ (examples show 2.13.x or newer such as 2.13.4.2 in Crowd/CWD references). Practical impact is d...
CVE-2022-26847
CVE-2022-26847 affects SPIP CMS: unauthenticated disclosure of information about editorial objects. Affected versions are SPIP 3.2.x before 3.2.14 and 4.x before 4.0.5. Root cause/reporting indicates information exposure without authentication. The vulnerability impacts information visibility rat...
CVE-2022-0890
CVE-2022-0890: NULL pointer dereference in the mruby/mruby project prior to 3.2. Affected component is the mruby interpreter. Root cause is a NULL pointer dereference, leading to availability impact as described by CVSS (local, low attack complexity, user interaction required). The entry indicate...
CVE-2021-22783
CVE-2021-22783 affects Schneider Electric/Ritto Wiser Door (all versions). A CWE-200 information exposure vulnerability could enable session hijacking during communication between the door panel and the door. The available sources in connected documents confirm the issue and affected product, but...
CVE-2022-0813
CVE-2022-0813 affects PhpMyAdmin up to version 5.1.1 where an information disclosure can occur by crafting invalid requests that touch the lang parameter, the pma_parameter, and the cookie section. Exploitation could reveal potentially sensitive information. Linked advisories (openSUSE/SUSE GLSA,...
CVE-2022-0482
Easy!Appointments before 1.4.3 is affected by a Broken Access Control vulnerability that allows an unauthorized user to retrieve sensitive appointment data via a public-facing API endpoint (examples reference /index.php/backend_api/ajax_get_calendar_events) due to missing authentication/permissio...
nfe.domcavati.mg.gov.br Cross Site Scripting vulnerability OBB-2418341
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
fopsia.it Cross Site Scripting vulnerability OBB-2418312
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-26103
The CVE-2022-26103 entry relates to SAP NetWeaver (Real Time Messaging Framework) version 7.50. The connected documents corroborate a vulnerability where under certain conditions an attacker can access information, enabling information gathering for further exploits. Affected component: Real Time...
CVE-2022-22547
CVE-2022-22547 concerns the Simple Diagnostics Agent. Affected software: Simple Diagnostics Agent versions 1.0 through 1.57. The issue is an information disclosure vulnerability allowing an attacker to access restricted information via a random port range (9000–65535), enabling information gather...
CVE-2021-37208
CVE-2021-37208 affects Siemens RUGGEDCOM ROS devices (multiple models such as i800/i801/i802/i803, M2100/M2200, RMC8388/RS... etc). The root cause is improper neutralization of special characters on the web server configuration page, enabling cross-site scripting in a privileged context and poten...
PT-2022-15516 · Unknown · Simple Diagnostics Agent
Name of the Vulnerable Software and Affected Versions: Simple Diagnostics Agent versions 1.0 through 1.57 Description: The issue allows an attacker to access restricted information via a random port between 9000 and 65535. This enables information gathering that could potentially be used to explo...
Church Admin < 3.4.135 - Unauthenticated Plugin's Backup Disclosure
The plugin does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to...