2291 matches found
CVE-2022-1157
Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged...
CVE-2022-0914
The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages including private and draft into an arbitrary CSV file, which the attacker can then download and retrieve the list of...
PT-2022-13679 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 14.7.7 GitLab CE/EE version 14.8 prior to 14.8.5 GitLab CE/EE version 14.9 prior to 14.9.2 Description: The issue is related to missing sanitization of logged exception messages in GitLab CE/EE, which can cause...
ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF
The plugin lacks authorization checks in the tainsertexternalimage action, allowing a low-privilege user with a role as low as Subscriber to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the...
AZL-9236 CVE-2020-35501 affecting package kernel for versions less than 5.15.41.1-1
A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem...
CVE-2022-0862 ePO password change vulnerability
A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator ePO prior to 5.10 Update 13 allows a remote attacker to change the password of a compromised session without knowing the existing user's password. This functionality was removed from...
Amministrazione Aperta < 3.8 - Admin+ LFI
The plugin does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected...
CVE-2022-0687
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...
Spoofing
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...
WordPress plugin Amelia 跨站请求伪造漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. WordPress plugin Amelia 1.0.47 previously had a...
CVE-2022-22734
The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a result, attacker could make a logged in admin create or edit arbitrary quote, and put Cross-Site Scripting payloads in them...
CVE-2021-32009
Cross-site Scripting XSS vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions...
CVE-2021-32009
Cross-site Scripting XSS vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions...
GateManager跨站脚本漏洞
Secomea GateManager is a remote access server product from Secomea, Denmark. A security vulnerability exists in Secomea GateManager that allows a logged in user to inject javascript during a browser session...
Kofax Printix Secure Cloud Print Management 竞争条件问题漏洞
Kofax Printix Secure Cloud Print Management is a cloud-based print management software from Kofax USA that is flexible, scalable and easy to use. Manage and maintain complex print environments anytime, anywhere with all the modern printing features users and organizations need. A security...
CVE-2022-0442 UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar...
CVE-2021-32008 Logged-in Administrator may get unrestricted file system access
This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories...
CVE-2021-44321
Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery CSRF, where an attacker can update/delete items in the inventory. The attacker must be logged into the application create a malicious file for updating the inventory details and items...
CVE-2021-44321
Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery CSRF, where an attacker can update/delete items in the inventory. The attacker must be logged into the application create a malicious file for updating the inventory details and items...
