5085 matches found
CVE-2021-38734
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via AntMenu.php...
SEMCMS SQL Injection Vulnerability
SEMCMS is a multilingual content management system CMS for foreign trade websites. A SQL injection vulnerability exists in SEMCMS SHOP version 1.1, which stems from a SQL injection issue in AntMenu.php...
Stored XSS - Entity name not sanitize in Ticket creation page
Description An Administrator can set a Cross-Site Scripting XSS payload inside an entity name. This XSS will be executed on the Ticket Creation page Menu - Assistance - Create Ticket. Proof of Concept 1. Set an XSS in Entity name 2. Go to the "Create Ticket" page 3. XSS is excuted...
SUSE-SU-2022:3750-1 Security update for SUSE Manager Server 4.3
This update fixes the following issues: cobbler: - Consider case of 'nextserver' being a hostname during migration of Cobbler collections. - Fix problem with 'proxyurlext' setting being None type. - Fix settings migration schema to work while upgrading on existing running Uyuni and SUSE Manager...
October 25, 2022—KB5018483 (OS Build 22000.1165) Preview
None None...
CVE-2022-24697: Improper Neutralization of Special Elements used in an OS Command
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the comma...
CVE-2022-24697
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the comma...
August 9, 2022—KB5016629 (OS Build 22000.856)
None None...
Cross site request forgery (csrf)
nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...
CVE-2022-39264
nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...
CVE-2022-39264 nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver
nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...
CVE-2022-39264
nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...
CVE-2022-40337
OASES aka Open Aviation Strategic Engineering System 8.8.0.2 allows attackers to execute arbitrary code via the Open Print Folder menu...
Open Aviation Strategic Engineering System security vulnerabilities
Valsoft Open Aviation Strategic Engineering System OASES is an aviation engineering and maintenance system from Valsoft Corporation of Canada. A security vulnerability exists in Open Aviation Strategic Engineering System version 8.8.0.2 that could allow an attacker to execute arbitrary code via t...
PT-2022-25352
Name of the Vulnerable Software and Affected Versions OASES aka Open Aviation Strategic Engineering System version 8.8.0.2 Description The issue allows attackers to execute arbitrary code via the Open Print Folder menu. Recommendations For OASES aka Open Aviation Strategic Engineering System...
JFinal SQL Injection Vulnerability
JFinal is a Java language based WEB + ORM open source framework. JFinal CMS 5.1.0 SQL injection vulnerability exists , the vulnerability stems from the id, name, menu key interface does not use the same components , there is no filter , but each uses its own SQL connection , resulting in SQL...
CVE-2022-38285
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list...
CVE-2022-38285
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list...
