CVE-2022-29237

Opencast exposes a cross-tenant access flaw: before versions 10.14 and 11.7, an attacker with full access to the ingest REST interface and knowledge of internal links could import files from another organization within the same multi-tenant cluster, bypassing organizational barriers. The issue is...

General Motors suffers credential stuffing attack

American car manufacturer General Motors GM says it experienced a credential stuffing attack last month. During the attack customer information and reward points were stolen. The subject of the attack was an online platform, run by GM, to help owners of Chevrolet, Buick, GMC, and Cadillac vehicle...

SIM-based Authentication Aims to Transform Device Binding Security to End Phishing

Let's face it: we all use email, and we all use passwords. Passwords create inherent vulnerability in the system. The success rate of phishing attacks is skyrocketing, and opportunities for the attack have greatly multiplied as lives moved online. All it takes is one password to be compromised fo...

Multi Store Inventory Management System授权问题漏洞

Multi Store Inventory Management System is a multi-store inventory management system. version 1.0 of Multi Store Inventory Management System is vulnerable to an authorization issue. An attacker can exploit this vulnerability to perform an account takeover via a specially crafted POST request...

Diary Management System Cross-Site Scripting Vulnerability

Diary Management System is a multi-user diary management system that enables staff in an organization to set/update/view meetings and appointments. The system will run through a central server, but clients will be able to run offline. A cross-site scripting vulnerability exists in Diary Managemen...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale which is packaged in IBM ESS (CVE-2020-4926)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale which is packaged in IBM ESS where an unauthorized user can send arbitrary data to the CLI commands and daemon. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2020-4926 DESCRIPTION...

RUSTSEC-2022-0031 Panic due to improper UTF-8 indexing

When parsing untrusted rulex expressions, rulex may panic, possibly enabling a Denial of Service attack. This happens when the expression contains a multi- byte UTF-8 code point in a string literal or after a backslash, because rulex tries to slice into the code point and panics as a result. The...

CVE-2017-14476

In the MMM::Agent::Helpers::Network::addip function in MySQL Multi-Master Replication Manager MMM mmmagentd 2.2.1 for Solaris, a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\agentd process. An...

Improper path handling in Kustomization files allows for denial of service

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted kustomization.yaml to cause Denial of Service at controller level. In multi-tenancy deployments this can lead to multiple...

GHSA-7PWF-JG34-HXWP Improper path handling in Kustomization files allows for denial of service

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted kustomization.yaml to cause Denial of Service at controller level. In multi-tenancy deployments this can lead to multiple...

CVE-2022-28993

Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...

CVE-2022-28991

Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to access sensitive files...

CVE-2022-28993

Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...

Cross site request forgery (csrf)

Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request...

CVE-2022-28993

The CVE-2022-28993 entry concerns Multi Store Inventory Management System v1.0 with an authorization issue that enables account takeover via a crafted POST request. Affected component is the web application’s access control logic; root cause is not explicitly detailed across sources, but multiple...

CVE-2022-28991

CVE-2022-28991 affects Multi Store Inventory Management System v1.0. The described vulnerability is an information disclosure that could allow attackers to access sensitive files. The provided documents do not specify the root cause, exploit details, or a remediation/fix. No exploitation status i...

Multi Store Inventory Management System 安全漏洞

Multi Store Inventory Management System is a multi-store inventory management system. version 1.0 of Multi Store Inventory Management System contains an information disclosure vulnerability that could be exploited by attackers to access sensitive files...

Multi-Vendor Online Groceries Management System SQL注入漏洞

Multi-Vendor Online Groceries Management System is a multi-vendor online grocery management system. A SQL injection vulnerability exists in Multi-Vendor Online Groceries Management System version 1.0, which can be exploited by an attacker to obtain sensitive database information via the id...

Multi Store Inventory Management System授权问题漏洞

Multi Store Inventory Management System is a multi-store inventory management system. version 1.0 of Multi Store Inventory Management System is vulnerable to an authorization issue. An attacker can exploit this vulnerability to perform an account takeover via a specially crafted POST request...

PT-2022-19349 · Unknown · Bdtask Multi-Store Inventory Management System

Name of the Vulnerable Software and Affected Versions: Multi Store Inventory Management System version 1.0 Description: The issue allows attackers to perform an account takeover by sending a crafted POST request. Recommendations: For Multi Store Inventory Management System version 1.0, update to ...