PT-2022-9640

Name of the Vulnerable Software and Affected Versions Advanced Cron Manager WordPress plugin versions prior to 2.4.2 Advanced Cron Manager Pro WordPress plugin versions prior to 2.5.3 Description The issue concerns a lack of authorization checks in some AJAX actions of the affected plugins,...

Open redirect

Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could host a webserver which serves a malicious Mirantis Container Cloud configuration file and induce...

CVE-2021-29394

Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST...

Cross site request forgery (csrf)

Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST...

PT-2022-16443

Name of the Vulnerable Software and Affected Versions Sante DICOM Viewer Pro version 13.2.0.21165 Description This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file...

CVE-2021-41040

In Eclipse Wakaama, ever since its inception until 2021-01-14, the CoAP parsing code does not properly sanitize network-received data...

Sourcecodester Simple Client Management System SQL注入漏洞

Sourcecodester Simple Client Management System is a simple web-based application that provides an online platform to manage company customer invoices. sourcecodester Simple Client Management System is vulnerable to SQL injection vulnerability, which stems from the application's lack of validation...

PT-2022-11642

Name of the Vulnerable Software and Affected Versions PrinterLogic Web Stack versions 19.1.1.13 SP9 and below Description The issue is related to the lack of sanitization of user input, resulting in pre-auth remote code execution. Recommendations For PrinterLogic Web Stack versions 19.1.1.13 SP9...

PT-2022-12881

Name of the Vulnerable Software and Affected Versions Bentley View version 10.15.0.75 Description This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw...

PT-2022-12891

Name of the Vulnerable Software and Affected Versions Bentley View version 10.15.0.75 Description This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required to exploit this issue, where the target must visit a malicious page or open a...

Bentley MicroStation CONNECT JT File Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

HTTP Request Smuggling (HRS)

varnish is vulnerable to HTTP request smuggling. The vulnerability exists due to a lack of sanitization in the HTTP/1 connections...

PT-2022-11218

Name of the Vulnerable Software and Affected Versions Hitachi Energy LinkOne versions 3.20 through 3.26 Description The issue is related to a configuration vulnerability in the Hitachi Energy LinkOne application, specifically due to the lack of HTTP Headers. This allows an attacker to potentially...

mingSoft Mcms SQL Injection Vulnerability (CNVD-2022-09254)

MingSoft Mcms is China's MingFei MingSoft company's a complete open source J2ee system . A security vulnerability exists in MingSoft Mcms that stems from a database-based application that lacks validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute...

PT-2022-4964

Name of the Vulnerable Software and Affected Versions Valmet System 2019 Metso DNA affected versions not specified Description The issue is related to the lack of authentication for a critical function in the software. This could allow a remote attacker to execute arbitrary code on the server...

SourceCodester Hospital Patient Records Management System Cross-Site Scripting Vulnerability

SourceCodester Hospital Patient Records Management System is a web-based PHP application that provides an automated platform for hospitals to store and manage their patient records. A cross-site scripting vulnerability exists in version 1.0 of the Management System. The vulnerability is related t...

Anyone can withdraw others

Handle robee Vulnerability details Anyone can withdraw users shares. Although we think that they are sent to the right address, it is still 1 not the desired behavior 2 can be dangerous if the receiver is a smart contract 3 the receiver may not know someone withdraw him...

PT-2022-15049

Name of the Vulnerable Software and Affected Versions Jupyter Server Proxy versions prior to 3.2.1 Description The issue is related to Server-Side Request Forgery SSRF due to a lack of input validation, allowing authenticated clients to proxy requests to other hosts and bypass the allowed hosts...

Rapid7 Insight Agent Arbitrary File Reading Vulnerability

Rapid7 Insight Agent is a lightweight software from Rapid7, Inc. that collects data from IT assets. The software is capable of collecting data from IT assets.An arbitrary file reading vulnerability exists in Rapid7 Insight Agent versions prior to 3.1.3, which stems from the software's lack of...

CVE-2022-20617

An OS command execution vulnerability was found in the Jenkins Docker Commons plugin. Due to a lack of sanitization in the name of an image or a tag, an attacker with Item/Configure permission or the ability to control the contents of a previously configured job’s SCM repository may be able to...