4810 matches found
CVE-2022-33910
CVE-2022-33910 affects MantisBT before 2.25.5. Affected area: attaching crafted SVG documents to issue reports or bugnotes. Root cause: file_download.php opens the SVG in a browser tab instead of downloading it as a file, enabling JavaScript execution in the context of the user’s browser. Impact:...
CVE-2022-30119
XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...
MantisBT 跨站脚本漏洞
MantisBT is the Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in MantisBT versions prior to 2.25.5, which originated from a...
The vulnerability of the Reports sub-component of the Oracle Financial Services Crime and Compliance Investigation Hub component of the banking analytics system’s simulation model, allowing a perpetrator to gain access to modify, add, or delete data.
The vulnerability of the Reports sub-component of the Oracle Financial Services Crime and Compliance Investigation Hub component of the banking analytics system’s simulation model exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to modify,...
Hindu Matrimonial Script 安全漏洞
PHP Matrimonial Script Hindu Matrimonial Script is an online matrimonial service website from PHP Matrimonial Script India. A security vulnerability exists in Hindu Matrimonial Script that stems from improperly managed permissions in /admin/reports.php...
MAL-2022-1549 Malicious code in bfx-reports-framework (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c91401ae4d7bf54dad96d13c79dbe2470122cd840dc7ebc1abef3273f3c26c7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in bfx-reports-framework (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c91401ae4d7bf54dad96d13c79dbe2470122cd840dc7ebc1abef3273f3c26c7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in youtrack-reports-widgets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b732af593b170277e15300a0a934c0b107bb8df0e470062ced5f8076aeef0e0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-7367 Malicious code in youtrack-reports-widgets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b732af593b170277e15300a0a934c0b107bb8df0e470062ced5f8076aeef0e0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Cervantes - Collaborative Platform For Pentesters Or Red Teams Who Want To Save Time To Manage Their Projects, Clients, Vulnerabilities And Reports In One Place
Cervantes is an opensource collaborative platform for pentesters or red teams who want to save time to manage their projects, clients, vulnerabilities and reports in one place. Features OpenSource Multiplatform Multilanguage Team Collaboration BuiltIn dashbaords and analytics Manage your clients...
CVE-2022-20204
In registerRemoteBugreportReceivers of DevicePolicyManagerService.java, there is a possible reporting of falsified bug reports due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2022-20204
In registerRemoteBugreportReceivers of DevicePolicyManagerService.java, there is a possible reporting of falsified bug reports due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2022-20204
In registerRemoteBugreportReceivers of DevicePolicyManagerService.java, there is a possible reporting of falsified bug reports due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
Design/Logic Flaw
In registerRemoteBugreportReceivers of DevicePolicyManagerService.java, there is a possible reporting of falsified bug reports due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
hip.fetishp.com Cross Site Scripting vulnerability OBB-2649895
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Google Android 安全漏洞
Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which originates in DevicePolicyManagerService.java's registerRemoteBugreportReceivers. Due to the lack of permission checking, a forged error report ma...
CVE-2022-31974
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=reports&date=...
CVE-2022-31953
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidentreports/viewreport.php?id=...