72 matches found
CVE-2022-40772: Undefined Security Weakness
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module...
CVE-2022-40772
CVE-2022-40772 affects Zoho ManageEngine ServiceDesk Plus versions 13010 and earlier. A validation bypass in the report module allows an attacker to access sensitive data. Public details in the initial and linked records confirm the affected product/version and the data exposure via the report mo...
CVE-2022-40772
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module...
PT-2022-25531 · Zoho · Zoho Manageengine Servicedesk Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior Description: The issue is related to a validation bypass that allows users to access sensitive data via the report module. This is due to improper input validation, which can lead to...
CVE-2022-38538
Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module...
CVE-2022-38538
Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module...
Sql injection
Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module...
CVE-2022-38538: Improper Neutralization of Special Elements used in an SQL Command
Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module...
PT-2022-24444 · Archery · Archery
Name of the Vulnerable Software and Affected Versions: Archery versions 1.7.0 through 1.8.5 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the checksum parameter in the report module. Recommendations: For versions 1.7.0 through 1.8.5, a...
Archery SQL注入漏洞
Archery is a set of open source vulnerability assessment and management tools. A security vulnerability exists in Archery versions v1.7.0 through v1.8.5, which stems from the checksum parameter in the report module containing a SQL injection vulnerability...
CVE-2022-38538
Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module...
CVE-2021-44874
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. The bi report modul...
CVE-2021-44874
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. The bi report modul...
Sql injection
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. The bi report modul...
CVE-2021-44874
CVE-2021-44874 affects Dalmark Systems Systeam 2.22.8 build 1724. The issue is an insecure design in the BI report module, where the endpoint exposes direct SQL commands via POST data to assemble reports. This allows an authenticated user to submit a SQL prompt to the BI reporting endpoint, enabl...
Zoho Corporation ManageEngine OpManager SQL注入漏洞
Zoho Corporation ManageEngine OpManager is a comprehensive network monitoring software from Zoho Corporation, USA. It is used to manage routers, firewalls, servers, switches and printers. Zoho ManageEngine OpManager suffers from an SQL injection vulnerability that arises from insufficient cleanin...
AZL-7226 CVE-2021-36386 affecting package fetchmail for versions less than 6.4.22-1
reportvbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf valist argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any...
CVE-2015-4391: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for requests that delete reports via unspecified vectors...
Drupal CiviCRM private report module cross-site request forgery vulnerability
Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in Drupal CiviCRM private report, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform...