7944 matches found
Cross site request forgery (csrf)
An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POST request...
CVE-2022-36604
An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POST request...
CVE-2022-36604
The CVE-2022-36604 issue affects Canaan Avalon ASIC Miner firmware versions 2020.3.30 and earlier, due to an improper access-control vulnerability. An unauthenticated attacker can ACHIEVE arbitrary password changes by sending a crafted POST request, exposing a risk of account takeovers and potent...
PT-2022-23500 · Canaan · Canaan Avalon Asic Miner
Name of the Vulnerable Software and Affected Versions: Canaan Avalon ASIC Miner versions 2020.3.30 and below Description: The issue is related to an access control problem, allowing unauthenticated attackers to change user passwords using a crafted POST request. Recommendations: For Canaan Avalon...
Authentication flaw
An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system Camera, Decoder and Encoder and bellow allows attckers to remotely reboot the device via a crafted POST request to the endpoint /ptipupgrade.cgi. Security information ID...
CVE-2022-2267
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users such as subscriber to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan priva...
CVE-2022-2267
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users such as subscriber to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan priva...
CVE-2022-2267
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users such as subscriber to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan priva...
Cross site request forgery (csrf)
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for...
CVE-2022-2556
The CVE-2022-2556 issue affects the Mailchimp for WooCommerce WordPress plugin prior to 2.7.2. An authenticated AJAX action allows high-privilege users to make the server perform a POST to an internal LAN, and the request body is echoed in the response, enabling SSRF against private network resou...
CVE-2022-2267 MailChimp for Woocommerce < 2.7.1 - Subscriber+ SSRF
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users such as subscriber to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan priva...
CVE-2022-27546
HCL iNotes is susceptible to a Reflected Cross-site Scripting XSS vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser with...
Cross site scripting
HCL iNotes is susceptible to a Reflected Cross-site Scripting XSS vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser with...
CVE-2022-37680
CVE-2022-37680 affects Hitachi Kokusai Electric Network products’ monitoring system (Camera, Decoder, Encoder). An improper authentication flaw allows remote reboot via a crafted POST to /ptipupgrade.cgi. Impact is high (NVD/Hitachi metrics: availability loss). Remediation is to apply fixes under...
CVE-2022-37680
An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system Camera, Decoder and Encoder and bellow allows attckers to remotely reboot the device via a crafted POST request to the endpoint /ptipupgrade.cgi. Security information ID...
Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi
The plugin does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections POST /wp-admin/admin-ajax.php HTTP/1.1 Accept:...
ZK Framework vulnerable to malicious POST
ZK Framework version 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader...
CVE-2022-36537
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader...