402 matches found
CVE-2023-35809: Improper Control of Generation of Code
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing input validation. Regular user privileges...
CVE-2021-4341
The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stmupdateemaildata AJAX action in versions up to, and including, 1.6.6. This makes it possible for unauthenticated...
CVE-2021-4341 uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX
The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stmupdateemaildata AJAX action in versions up to, and including, 1.6.6. This makes it possible for unauthenticated...
PT-2023-12444 · WordPress · Ulisting
Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue allows for authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stm update emai...
Mitsubishi Electric 多款产品安全漏洞
The Mitsubishi Electric MELSEC iQ-R series and the Mitsubishi Electric MELSEC iQ-F series are both programmable logic controllers from Mitsubishi Electric Japan. A security vulnerability exists in several Mitsubishi Electric products, which is caused by a missing mask when entering a password fie...
PT-2023-20508 · Unknown · Keep-Module-Latest
Name of the Vulnerable Software and Affected Versions: keep-module-latest versions all Description: The issue arises due to missing input sanitization or other checks and sandboxes being employed to the installModule function, leading to Command Injection. To potentially exploit this, an attacker...
CVE-2023-26128: Improper Neutralization of Special Elements used in an OS Command
All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function. Note: To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have...
Siemens Siveillance Video Mobile Server 代码问题漏洞
Siveillance Video formerly known as Siveillance VMS is an IP video management software designed for deployments ranging from small and simple to large and highly secure. A code execution vulnerability exists in Siemens Siveillance Video due to the event server component of the affected applicatio...
CVE-2023-26060
An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an external attacker, it is very difficult t...
CVE-2023-26060: Improper Control of Generation of Code
An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an external attacker, it is very difficult t...
Online Payroll System 跨站脚本漏洞
Online Payroll System is a system for distributing payroll online. A cross-site scripting vulnerability exists in Online Payroll System, which stems from the lack of effective filtering and escaping of user-supplied data in /admin/deductionedit.php, and can be exploited by attackers to execute...
Atlassian Jira 7.0.8 < 7.13.9 DoS Via Missing Input Validation In Userpickerbrowser
According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is version 7.0.8 prior to 7.13.9 or 8.0.0 prior to 8.5.0. It is, therefore, affected by a vulnerability which permits remote attackers to impact the application's availability via a Denia...
Atlassian 8.0.0 < 8.5.0 DoS Via Missing Input Validation In Userpickerbrowser
According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is version 7.0.8 prior to 7.13.9 or 8.0.0 prior to 8.5.0. It is, therefore, affected by a vulnerability which permits remote attackers to impact the application's availability via a Denia...
EulerOS 2.0 SP8 : freerdp (EulerOS-SA-2023-1313)
According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using /parallel command line switch might...
CISA Alert: Oracle E-Business Suite and SugarCRM Vulnerabilities Under Attack
The U.S. Cybersecurity and Infrastructure Security Agency CISA on February 2 added two security flaws to its Known Exploited Vulnerabilities KEV Catalog, citing evidence of active exploitation. The first of the two vulnerabilities is CVE-2022-21587 CVSS score: 9.8, a critical issue impacting...
CVE-2022-25906: Improper Neutralization of Special Elements used in an OS Command
All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function...
CVE-2022-21192
All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join...
CVE-2022-4235
RushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. This is possible because the application exposes an activity and does not properly validate the data it receives...