17643 matches found
ASB-A-177927831
In getDefaultSmsPackage of RoleManagerService.java, there is a possible way to get information about the default sms app of a different device user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction i...
ASB-A-190404324
Bulletin has no description...
CVE-2021-35239 Stored XSS in Maps text box hyperlink Vulnerability
A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink...
Code injection
IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-ForceID: 201100...
CVE-2021-29722
CVE-2021-29722 affects IBM Sterling Secure Proxy components: 2.4.3.2, 3.4.3.2, 6.0.1, and 6.0.2. The root cause is use of weaker cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Evidence from multiple sources (NVD entry and IBM security bulletins) con...
Design/Logic Flaw
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "errorrelatedto" parameters of the POST request of the bounce management callback will be permanently stored and execute...
CVE-2021-27910
CVE-2021-27910 describes a stored XSS in Mautic via the bounce management callback. The vulnerability arises from insufficient sanitization of the POST parameters error and error_related_to in the callback endpoint (POST /mailer//callback). An attacker with access to the callback can inject arbit...
CVE-2020-18476
HuCartCMS 5.7.4 is affected by a SQL injection vulnerability in the usd_image field (reported as header/avatar usd_image in some sources). The CVE-2020-18476 entry documents a SQLi in HuCartCMS 5.7.4 via this field, with high severity in CVSS 3.1 (8.8) and medium in CVSS 2.0 (6.5). Concrete detai...
CVE-2020-18469
CVE-2020-18469 is a stored XSS vulnerability in Rukovoditel 2.4.1 affecting the Copyright Text field in the Configuration > Application page. An authenticated user can inject arbitrary web script/HTML by sending a crafted website name via a POST to /rukovoditel_2.4.1/index.php?module=configura...
CVE-2020-18468
CVE-2020-18468 affects qdPM 9.1. An XSS exists in the Login Page heading field under the General menu, exploitable via a crafted website name through an authenticated POST to /qdPM_9.1/index.php/configuration. The issue stems from insufficient input validation on the heading, enabling client-side...
MTN Group: Password reset token leak on third party website via Referer header [cloudivr.mtnbusiness.com.ng]
Summary: F1426175 It has been identified that the application is leaking referrer token to third party sites. In this case it was found that the password reset token is being leaked to third party sites which is a issue knowing the fact that it can allow any malicious users to use the token and...
CVE-2020-18972
Summary: PoDoFo library v0.9.6 is affected by an information disclosure vulnerability via IsNextToken in src/base/PdfToenizer.cpp, enabling an unauthorized actor to obtain sensitive information. This CVE is referenced across multiple sources (NVD, CNVD, OSV, Debian tracker). The provided document...
CVE-2021-28697
No description is available for this CVE...
CVE-2021-28698
No description is available for this CVE...
CVE-2021-28694
No description is available for this CVE...
CVE-2021-33605
CVE-2021-33605 affects com.vaadin:vaadin-checkbox-flow across multiple versions (1.2.0–2.0.0 for Vaadin 12–14, 2.0.0–3.0.0 for Vaadin 14, 3.0.0–4.0.1 for Vaadin 15–17, 14.5.0–14.6.7, 18.0.0–20.0.5). Root cause: improper check in CheckboxGroup permits modifying the value of a disabled Checkbox ins...
JVN#97545738: Multiple cross-site scripting vulnerabilities in Movable Type
Movable Type provided by Six Apart Ltd. contains multiple cross-site scripting vulnerabilities listed below. Cross-site scripting vulnerability in Search screen CWE-79 - CVE-2021-20808 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS...
Online Leave Management System 1.0 Shell Upload
Exploit Title: Online Leave Management System 1.0 - Arbitrary File Upload to Shell Unauthenticated Date: 24-08-2021 Exploit Author: Justin White Vendor Homepage: https://www.sourcecodester.com Software Link:...