Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting

Vulnerability Type Stored Cross Site-Scripting XSS Affected URL https://localhost/openemr-6.0.0/ /interface/super/rules/index.php?action=edit!submitsummary Affected Parameters “fldtitle” Authentication Required? Yes Issue Summary Non-privilege users accounting, front-office can create new rule an...

DRUPAL-CORE-2022-005

The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content even without...

SAP SAPCAR suffers from an input validation error vulnerability

SAP SAPCAR is a utility program from SAP Germany for compressing and/or decompressing SAP archive files. An input validation error vulnerability exists in SAP SAPCAR that stems from a failure to perform sufficient input validation. An attacker could exploit the vulnerability to gain privileged...

CVE-2022-26100

SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obtain privileged access to the system...

CVE-2022-26100

SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obtain privileged access to the system...

CVE-2022-24396

The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities an...

CVE-2022-24396

The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities an...

Veritas System Recovery安全漏洞

Veritas System Recovery is a system recovery software from Veritas, USA. The software provides Windows systems with the ability to recover a corrupted system without reinstalling the system. A security vulnerability exists in Veritas System Recovery VSR 18 and 21, which originates from storing...

SAP SAPCAR 输入验证错误漏洞

SAP SAPCAR is a utility program from SAP Germany for compressing and/or decompressing SAP archive files. An input validation error vulnerability exists in SAP SAPCAR that stems from a failure to perform sufficient input validation. An attacker could exploit the vulnerability to gain privileged...

CVE-2022-26100

SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obtain privileged access to the system...

CVE-2022-26100

CVE-2022-26100 affects SAPCAR 7.22 and stems from insufficient input validation in the SAPCAR archive handling. The vulnerability can cause the SAPCAR process to crash and may allow an attacker to obtain privileged access to the system. Connected sources (Red Hat, CNVD, CNNVD, NVD, PRION, CNVD va...

CVE-2021-3738

In DCE/RPC it is possible to share the handles cookies for resource state between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only...

Design/Logic Flaw

In DCE/RPC it is possible to share the handles cookies for resource state between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only...

Watchguard WatchGuard Firebox 安全漏洞

Watchguard WatchGuard Firebox is a US-based Watchguard company that provides a comprehensive range of network security services, from traditional IPS and GAV, to website/application control and malicious software prevention. A security vulnerability exists in WatchGuard Firebox that originates in...

Information Security Consultant – Job Description and How to Become

Introduction As per Centrify, a forerunner in the Privileged Access Management PAM market that forms programming to forestall cyberattacks, the huge ascent of people working from a distance during the COVID-19 pandemic has raised the probability of a digital break. Therefore, network protection h...

CVE-2021-20320

A flaw was found in s390 eBPF JIT in bpfjitinsn in arch/s390/net/bpfjitcomp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem...

CVE-2021-22042

VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high privileged user...

PT-2022-11363 · Snow · Snow Snow Inventory Java Scanner

Name of the Vulnerable Software and Affected Versions: SNOW Snow Inventory Java Scanner version 1.0 Description: A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. Recommendations: For SNOW Snow Inventory Java Scanner version...

CVE-2021-4035

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...

Samsung Bixby Vision 代码注入漏洞

Samsung Bixby Vision is a vision feature from the South Korean company Samsung Samsung. It allows you to access information about the world around you by simply turning on the camera. Samsung Bixby Vision has a security vulnerability that can be exploited by an attacker to perform privileged...