CVE-2022-39020 Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd

Multiple instances of XSS stored and reflected was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting...

WordPress WP User Frontend plugin <= 3.5.28 - Obscure Registration as Admin vulnerability

Obscure Registration as Admin vulnerability discovered by AyeCode Ltd in WordPress WP User Frontend plugin versions = 3.5.28. Solution Update the WordPress WP User Frontend plugin to the latest available version at least 3.5.29...

Huatian Power OA suffers from XML Entity Injection Vulnerability

Huatian Power OA belongs to Dalian Huatian Software Co., Ltd. and is collaborative office software OA. An XML entity injection vulnerability exists in Huatian Power OA, which can be exploited by attackers to obtain sensitive information...

File Upload Vulnerability in Huatian Power Collaboration Office System

Dalian Huatian Software Co., Ltd. is a high-tech enterprise organized in accordance with the international advanced management mode and system, and is a collaborative management software company known for its leading technology. A file upload vulnerability exists in Huatian Power Collaboration...

Logic Flaw Vulnerability in TY-6201A of Sichuan Tianyi Kanghe Communication Co.

The TY-6201A is a cost-effective full-band Wi-Fi6-enabled wireless router. A logic flaw vulnerability exists in the TY-6201A of Sichuan Tianyi Kanghe Communication Company Limited, which can be exploited by an attacker to change a password without permission via a POST request for a specific path...

Information Disclosure Vulnerability in TY-6201A of Sichuan Tianyi Kanghe Communication Co.

The TY-6201A is a cost-effective full-band Wi-Fi6-enabled wireless router. An information disclosure vulnerability exists in the TY-6201A of Sichuan Tianyi Kanghe Communication Co. which can be exploited by attackers to obtain sensitive information...

belgianlegacyltd.com Cross Site Scripting vulnerability OBB-2939525

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-38532

Micro-Star International Co., Ltd MSI Center 1.0.50.0 was discovered to contain a vulnerability in the component CFeatures of MSI.CentralServer.exe. This vulnerability allows attackers to escalate privileges via running a crafted executable...

CVE-2022-38532

Micro-Star International Co., Ltd MSI Center 1.0.50.0 was discovered to contain a vulnerability in the component CFeatures of MSI.CentralServer.exe. This vulnerability allows attackers to escalate privileges via running a crafted executable...

Shenzhen Lanning Software Co., Ltd. has SQL injection vulnerability in Lanning Intelligent Collaboration Platform

Shenzhen Lailing Software Co., Ltd. is a well-known large platform OA service provider and a leading knowledge management solution provider in China. It is a national high-tech enterprise specializing in knowledge-based consulting, software development, implementation and technical services for...

Information leakage vulnerability in Netnifty Security Gateway System of Beijing Netnifty Information Technology Co.

Ltd. covers network boundary security protection, application and data security protection, network-wide security risk management, professional security solutions and professional security services. Ltd. has an information leakage vulnerability in its security gateway system, which can be exploit...

Beijing Century Superstar Information Technology Development Co., Ltd.'s Learning Pass suffers from a stored XSS vulnerability

LearningTone is a course learning, knowledge dissemination and management sharing platform built on a microservice architecture. There is a stored XSS vulnerability in Beijing Century Super Star Information Technology Development Limited Liability Company's Learning Pass, which can be exploited b...

CVE-2022-38078

CVE-2022-38078 affects Movable Type XMLRPC API. A POST request to the XMLRPC endpoint can execute arbitrary Perl scripts and OS commands due to a command-injection flaw in MT/MT Advanced/MT Premium lines (versions 7 r.5202 and earlier; 6.8.6 and earlier; 1.52 and earlier). All MT 4.0+ EOL version...

JVN#57728859: Movable Type XMLRPC API vulnerable to command injection

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability CWE-74. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. According to the...

JVN#46239102: Multiple vulnerabilities in Exment

Exment provided by Kajitori Co.,Ltd contains multiple vulnerabilities listed below. Reflected cross-site scripting CWE-79 - CVE-2022-38080 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4 CVSS v2| AV:N/AC:H/Au:S/C:N/I:P/A:N| Base Score: 2.1...

File upload vulnerability exists in the website building system of Hangzhou Bocai Network Technology Co.

Ltd. is an innovative company that provides comprehensive digital services including strategy consulting, visual design, technology development, content manufacturing and marketing. There is a file upload vulnerability in the website building system of Hangzhou Bocai Network Technology Co...

Matrimonial PHP Script 1.0 SQL Injection

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

Shenzhen Greenlink Technology Co., Ltd DH2100 has a logic flaw vulnerability

DH2100 is a private cloud product that focuses on simplicity and ease of use. Ltd. DH2100 has a logic flaw vulnerability, which can be exploited by attackers to obtain sensitive information...

CVE-2022-32458 Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection

Digiwin BPM has a XML External Entity Injection XXE vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files...

CVE-2022-32456 Data Systems Consulting Co., Ltd. BPM - SQL Injection

Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service...