Code injection

IBM CICS TX Standard and Advanced 11.1 could allow a user with physical access to the web browser to gain access to the user's session due to insufficiently protected credentials. IBM X-Force ID: 229446...

CVE-2022-22506

CVE-2022-22506 affects IBM Robotic Process Automation (RPA) 21.0.2 (and related deploys). The vulnerability could allow user IDs to be exposed across tenants, impacting confidentiality. The IBM Security Bulletin lists affected products/versions and provides remediation: upgrade to 21.0.2 IF002 or...

CVE-2024-22223

Dell Unity (hardware/software line) is affected by CVE-2024-22223, a local OS command injection in the svc_cbr utility for versions prior to 5.4. An authenticated attacker with local access could execute arbitrary OS commands with the privileges of the vulnerable application. The vulnerability st...

CVE-2024-22222

CVE-2024-22222 affects Dell Unity prior to 5.4. The vulnerability is an OS Command Injection in the svc_udoctor utility. An authenticated attacker with local access could run arbitrary commands on the underlying OS with the vulnerable application’s privileges, enabling high-impact access (as desc...

CVE-2024-22221

Dell Unity prior to version 5.4 contains a SQL Injection vulnerability in its operating environment (notably via the svc_cava utility) that can be exploited by an authenticated attacker to disclose sensitive information. The issue stems from insufficient protection of the SQL query structure, ena...

CVE-2024-22224

CVE-2024-22224 affects Dell Unity prior to 5.4. The vulnerability is an OS command injection in the svc_nas utility that, if exploited by an authenticated, locally-present attacker, could escape the restricted shell and execute arbitrary OS commands with root privileges . Documented exploit detai...

CVE-2024-22230

Dell Unity contains a Cross-site Scripting (XSS) vulnerability in versions prior to 5.4. The issue arises from inadequate protection of the web page structure, allowing an authenticated attacker to steal session information, masquerade as the affected user, perform actions the user can, or genera...

CVE-2024-22228

Dell Unity (prep 5.4) contains an OS command injection in the svc_cifssupport utility. An authenticated, local attacker could escape the restricted shell and run arbitrary OS commands with root privileges. Affected software: Dell Unity versions prior to 5.4. Root cause: lack of safeguards to neut...

CVE-2024-0164

Dell Unity is affected by an OS command injection in the svc_topstats utility of the Dell Unity OS, prior to version 5.4 . The root cause is an injection vulnerability that allows an authenticated attacker to execute arbitrary commands with elevated privileges, leading to a high-impact, local com...

CVE-2024-0165

Summary (CVE-2024-0165): Dell Unity before 5.4 contains an OS Command Injection in the svc_acldb_dump utility. An authenticated attacker could exploit this to execute arbitrary OS commands with root privileges. The vulnerability is documented across multiple sources (CNVD/CNNVD/PT security notes,...

Code injection

IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229441...

CVE-2024-0169

Dell Unity prior to v5.4 contains an input handling flaw in web page generation that enables cross-site scripting (XSS). A low-privilege, remote attacker could exploit this to exfiltrate information (cookie-based credentials). Affected: Dell Unity 5.3 and earlier. Remediation: upgrade to 5.4+ per...

CVE-2022-34311

CVE-2022-34311 affects IBM CICS TX Standard and IBM CICS TX Advanced 11.1. The issue allows a user with physical access to the web browser to gain access to the user’s session due to insufficiently protected credentials. CVSS v3 base score 4.3 (Attacker: Physical, Privileges Required: None, User ...

CVE-2022-34310

The CVE-2022-34310 issue affects IBM CICS TX Standard and Advanced 11.1, where weaker-than-expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Public documents confirm affected products and versions (IBM CICS TX Standard and IBM CICS TX Advanced, 11....

CVE-2022-38714

CVE-2022-38714 affects IBM DataStage on Cloud Pak for Data 4.0.6–4.5.2, where a privileged user could read stored database credentials. Root cause: exposure of sensitive credential information via DataStage components. Impact: confidentiality loss for credentials located in the runtime/processing...

Design/Logic Flaw

A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component via sending a crafted request to devicewebip...

Code injection

The EazyDocs WordPress plugin before 2.4.0 re-introduced CVE-2023-6029 https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e/ in 2.3.8, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. The issue was...

Cross site scripting

The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Sql injection

The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2023-6081

CVE-2023-6081 affects the WordPress Chart.js plugin “enigma-chartjs” up to version 2023.2. The vulnerability arises from insufficient sanitization/escaping of certain settings, potentially enabling Stored Cross-Site Scripting by high-privilege users (e.g., Editor) even when unfiltered_html is dis...