402 matches found
CVE-2023-32826
In camera middleware, there is a possible out of bounds write due to a missing input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07993539; Issue ID: ALPS07993544...
CVE-2023-23302
The Toybox.GenericChannel.setDeviceConfig API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the executi...
The vulnerability of the setUploadUserData function in the file /cgi-bin/cstecgi.cgi of the TOTOLINK A3002RH router’s microprogramming system allows a attacker to execute arbitrary commands.
The vulnerability of the setUploadUserData function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK A3002RH router’s microprogramming system is related to the lack of measures taken to neutralize special elements used in operating systems commands. Exploiting this vulnerability can allow a...
CVE-2022-32248
Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the value of an existing field in the database. This leads to an impact on the integrity of the data...
CVE-2021-29433
Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. A patch for the vulnerability i...
CVE-2019-0370
Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection...
SAP S/4HANA Cloud Private 代码注入漏洞
SAP S/4HANA Cloud Private is a private cloud-deployed, enterprise-grade, intelligent ERP suite based on in-memory computing architecture from SAP, Germany. A code injection vulnerability exists in SAP S/4HANA Cloud Private, which stems from a lack of input validation and authorization checking an...
CVE-2025-46628
Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the 'ate' service when it is enabled. Authentication is not needed...
PHPGurukul Restaurant Table Booking System 注入漏洞
Restaurant Table Booking System is a restaurant table reservation system. Restaurant Table Booking System suffers from a SQL injection vulnerability that originates from a missing validation of an externally entered SQL statement in the parameter fullname of the add-subadmin.php file. An attacker...
UBUNTU-CVE-2022-49048
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6forward when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev...
CVE-2024-7419: Improper Control of Generation of Code
The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. This is due to the missing input validation and sanitization of user-supplied data. This makes it possible for unauthenticated attackers to...
CVE-2020-6191
SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation...
Maid Hiring Management System /admin/search-maid.php File Cross-Site Scripting Vulnerability
Maid Hiring Management System is a maid hiring management system. The Maid Hiring Management System suffers from a cross-site scripting vulnerability that stems from a lack of sufficient input validation of the searchdata parameter in file /admin/search-maid.php. An attacker could use this...
CVE-2024-36498 Stored cross site scripting
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...
CVE-2024-47947 Stored cross site scripting
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...
CVE-2024-55546 Stored Cross-Site Scripting
Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting XSS.This issue affects IAP-420 version 2.01e and below...
PT-2024-36544
Name of the Vulnerable Software and Affected Versions ORing IAP-420 versions 2.01e and below Description The issue is caused by missing input validation in the web interface of ORing IAP-420, allowing stored Cross-Site Scripting XSS. This enables attackers to store malicious scripts on the device...
PT-2024-10296 · Planet Technology +1 · Planet Wgs-804Hpt +2
The affected product is susceptible to a stack-based buffer overflow, which can be triggered by an unauthenticated attacker sending a malicious HTTP request. The webserver fails to properly check input size before copying data to the stack, potentially allowing remote code execution. An exploit f...
The vulnerability of the HikCentral Master Lite video surveillance and security management software lies in the absence of a mechanism to neutralize certain elements in CSV files, allowing attackers to execute arbitrary commands.
The vulnerability of the HikCentral Master Lite video surveillance and security management software lies in the absence of a mechanism to neutralize certain elements in CSV files. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...