CVE-2024-12142

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modification of web page and denial of service when specific web pages are modified and restricted functions are invoked...

CVE-2024-12142

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modification of web page and denial of service when specific web pages are modified and restricted functions are invoked...

CVE-2024-12142

Schneider Electric Modicon M340, BMXNOE0100/0110 and BMXNOR0200H are affected by CVE-2024-12142 (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability allows information disclosure for restricted web pages, modification of web pages, and denial of service when sp...

CVE-2024-12142

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modification of web page and denial of service when specific web pages are modified and restricted functions are invoked...

Schneider Electric Modicon M340 信息泄露漏洞

The Schneider Electric Modicon M340 is a mid-range PLC programmable logic controller for industrial processes and infrastructure from Schneider Electric France. An information disclosure vulnerability exists in the Schneider Electric Modicon M340, which stems from the inclusion of an Exposure of...

PT-2024-10144 · Schneider Electric · Bmxnoe0100 +3

The issue at hand is related to a sensitive information exposure flaw, which could lead to the disclosure of restricted web pages, modification of web pages, and denial of service when specific web pages are modified and restricted functions are invoked. This flaw is identified by the CWE-200...

CVE-2024-5890

Technical details beyond the description are not provided in the connected documents. Monitor for updates from ServiceNow and vendors; apply patches when available.

PT-2024-37225 · Servicenow · Servicenow

Name of the Vulnerable Software and Affected Versions: ServiceNow affected versions not specified Description: The issue is related to an HTML injection vulnerability identified in the Now Platform. This could potentially enable an unauthenticated user to modify a web page or redirect users to...

ServiceNow Now Platform 安全漏洞

ServiceNow Now Platform is a cloud-based platform from US-based ServiceNow that uses AI and machine learning to automate and optimize work across the enterprise. A security vulnerability exists in ServiceNow Now Platform that stems from the presence of an HTML injection vulnerability that could...

MegaBIP SQL Injection Vulnerability

MegaBIP is a software for creating BIP websites. A security vulnerability exists in MegaBIP version 5.12.1 and prior versions. An attacker could exploit the vulnerability to disclose database content, obtain a session cookie, or modify page content...

Broken Access Control

TYPO3 is vulnerable to Broken Access Control. The vulnerability is due to backend users with limited access to specific languages being able to modify and create pages in the default language, which should be disallowed. A valid backend user account is required to exploit this vulnerability...

SUSE CVE-2022-24919

An authenticated user can create a link with reflected Javascript code inside it for graphs' page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all t...

OpenCMS Cross-Site Scripting vulnerability

Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user: with sufficient privileges to create and modify web pages through the admin panel, can execute malicious JavaScript code, after inserting code in the title field...

CVE-2023-20179

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could...

ROS-20230911-07

A vulnerability in the Moodle virtual learning environment is related to insufficient validation of user input data. data, an attacker could send a specially crafted HTTP request and make the application initiate requests to arbitrary systems. Exploitation of the vulnerability could allow an...

CVE-2022-45150

A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in...

CVE-2022-45150

A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in...

CVE-2022-41937 Missing Authorization in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. As a...

XWiki Platform 安全漏洞

XWiki Platform is the French company XWiki's set of Wiki platform for creating Web collaboration applications. An authorization issue vulnerability exists in XWiki Platform versions prior to 13.10.8, 14.0 and later, and 14.4.3 and earlier, which stems from incorrect privilege management and can b...

PT-2022-6993 · Cisco · Cisco Catalyst Sd-Wan Manager

Name of the Vulnerable Software and Affected Versions: Cisco Catalyst SD-WAN Manager affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote attacker to inject HTML content. This issue is due to improper validation of...