228 matches found
Cross site request forgery (csrf)
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery CSRF...
CVE-2022-36246 Shop Beat Services Vulnerable To Insecure Permissions
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions...
CVE-2022-36250
Shop Beat Media Player versions 2.5.95 through 3.2.57 are affected by a Cross Site Request Forgery (CSRF) vulnerability. The vulnerability enables CSRF attacks that could trick authenticated users into performing unintended actions. The connected PT-2023-13467 entry notes a CSRF issue and recomme...
CVE-2022-36247
Shop Beat Media Player versions 2.5.95–3.2.57 are vulnerable to an Insecure Direct Object Reference (IDOR) via controlpanel.shopbeat.co.za. The root cause is IDOR, leading to unauthorized access to resources; CVSS 3.1 indicates high confidentiality and integrity impact (score 9.1). No patch/versi...
CVE-2022-36246
CVE-2022-36246 affects Shop Beat Media Player versions 2.5.95 through 3.2.57. The issue is an insecure permissions vulnerability in the product, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8, Network attack, no user interaction). Root cause and technical exploit ...
Rapid7 Announces Partner of the Year Awards 2023 Winners
It’s with immense pleasure that we announce today the winners of the Rapid7 Partner of the Year Awards 2023. All our category winners have achieved exceptional growth—demonstrating their dedication to, and collaboration with, the Rapid7 Partner Program throughout the year. “We are incredibly...
SUSE-SU-2023:1698-1 Security update for sudo
This update for sudo fixes the following issue: Security fixes: - CVE-2023-28486: Fixed missing control characters escaping in log messages bsc1209362. - CVE-2023-28487: Fixed missing control characters escaping in sudoreplay output bsc1209361. Other fixes: - Fix a situation where 'sudo -U...
SUSE-SU-2023:1659-1 Security update for sudo
This update for sudo fixes the following issue: Security fixes: - CVE-2023-28486: Fixed missing control characters escaping in log messages bsc1209362. - CVE-2023-28487: Fixed missing control characters escaping in sudoreplay output bsc1209361. Other fixes: - Fix a situation where 'sudo -U...
SUSE CVE-2005-0023
gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed...
CVE-2022-43271
Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting XSS vulnerability via the User profile component...
Cross site scripting
Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting XSS vulnerability via the User profile component...
CVE-2022-43271
CVE-2022-43271 affects Inhabit Systems Move CRM version 4, build 260, with a cross-site scripting (XSS) vulnerability via the User profile component. Public details in the provided documents confirm the issue exists and indicate a CVSS v3.1 base score of 5.4 (MEDIUM) with network attack vector, l...
CVE-2022-3059 SQL injection in Schoolbox version 21.0.2, by Schoolbox Pty Ltd
The application was vulnerable to multiple instances of SQL injection authenticated and unauthenticated through a vulnerable parameter. Due to the stacked query support, complex SQL commands could be crafted and injected into the vulnerable parameter and using a sleep based inferential SQL...
CVE-2022-39020 Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd
Multiple instances of XSS stored and reflected was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting...
Amazon Linux 2 : golang-github-kr-pty (ALAS-2022-1864)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1864 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...
Linux kernel 竞争条件问题漏洞
The Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a memory corruption that can be triggered in the Linux kernel via ptyunthrottle, which can be exploited ...
deno (>=0.35.0 <=1.3.0), diss (>=0.0.1 <=0.2.10) +8 more potentially affected by unknown CVE via pty (>=0.1.6 <=0.2.2)
pty CARGO version =0.1.6, =0.35.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.0, =0.1.0 - webterm-rs =0.1.4 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0015...
RUSTSEC-2022-0015 pty is unmaintained
The repository hasn't received any updates since Jun 25, 2017 and the author is unresponsive. Maintained alternatives include: tokio-pty-process pty-process...
CVE-2022-25570
In Click Studios SA Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifically, an authenticated user who has write permissions to a password list in one folder with the default permission model can extend his...