231584 matches found
Information disclosure
IBM Cloud Pak for Security CP4S 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...
CVE-2021-39090
CVE-2021-39090 affects IBM Cloud Pak for Security (CP4S). CP4S versions 1.10.0.0 through 1.10.6.0 are vulnerable due to a failure to properly enable HTTP Strict Transport Security, enabling a remote attacker to obtain sensitive information via man-in-the-middle techniques. Impact is information d...
CVE-2024-0689
CVE-2024-0689 involves the Custom Field Suite plugin for WordPress, where a Stored XSS exists in meta imports for all versions up to 2.6.4 due to insufficient input sanitization and output escaping. Affected: WordPress multisite installations and sites with unfiltered_html disabled. Impact: authe...
Cross site scripting
Cross Site Scripting XSS vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the mainsettings component in the phone, address, bank, accname, accnumber parameters, newclass and cname parameter, addnewparent function in t...
Sql injection
SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the id parameter in the studentform.php and the classform.php pages...
Information disclosure
IBM Watson CloudPak for Data Data Stores information disclosure 4.6.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 248947...
CVE-2023-38367
The CVE-2023-38367 entry concerns IBM Cloud Pak Foundational Services Identity Provider (idP) API in IBM Cloud Pak for Automation across multiple releases (18.0.0 through 22.0.2 with various fixes). The issue allows CRUD operations with an invalid token, enabling an unauthenticated attacker to vi...
Design/Logic Flaw
A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in M&S Consulting Email Before Download.This issue affects Email Before Download: from n/a through 6.9.7...
Sql injection
F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in database...
Open redirect
Inadequate parsing of URLs could result into an open redirect...
Information disclosure
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2...
Sql injection
livehelperchat 4.28v is vulnerable to Server-Side Template Injection SSTI...
Memory corruption
Kerberos 5 aka krb5 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c...
Cross site scripting
Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Heureka Group Heureka.This issue affects Heureka: from n/a through 1.0.8...
Cross site scripting
Cross-site scripting XSS vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student Information Systems v.3053 allows remote attackers to inject arbitrary web script or HTML via the message parameter...