CVE-2022-1803

Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2...

CVE-2022-1803 Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk

Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2...

UI REDRESSING

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Proof of Concept Go to this URL:...

Arbitrary File Upload

shopxo/shopxo is vulnerable to arbitrary file upload. The vulnerability exists in three locations because the upload functions are not properly restricted which allows an attacker to upload malicious files...

Trudesk 安全漏洞

Chris Brame Trudesk is an open source helpdesk/ticketing solution from Chris Brame, USA. A security vulnerability exists in versions prior to Trudesk 1.2.2, which stems from an improper restriction in the UI layer or frames...

PT-2022-3610

Name of the Vulnerable Software and Affected Versions dicer versions all Description The issue is related to the dicer package, where a malicious attacker can send a modified form to the server, causing the Node.js service to crash. By sending the payload repeatedly, an attacker can achieve a...

Bypass Restriction and File Upload Leads to XSS Stored - TXT to HTML

Description Unrestricted file upload allowed the attacker to manipulate the request and bypass the protection of HTML files using a text file, XSS Stored was obtained when uploading the HTML file. Proof of Concept POST /admin/resources/upload HTTP/1.1 Host: demo-publify.herokuapp.com Cookie:...

CVE-2022-1670

When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users...

CVE-2022-1670

CVE-2022-1670 describes a vulnerability in Octopus Server where the validation on generated user invitation codes (the number of users the code remains valid for) can be bypassed, allowing creation of additional user accounts beyond the intended invited count. Affected: Octopus Server’s invitatio...

PT-2022-19757 · Unknown · Online Sports Complex Booking System

Name of the Vulnerable Software and Affected Versions: Online Sports Complex Booking System version 1.0 Description: The issue concerns SQL Injection via the "/scbs/classes/Users.php?f=save client" endpoint. This allows for potential manipulation of database queries, which could lead to...

CVE-2021-41946

In FiberHome VDSL2 Modem HG150-UbV3.0, a stored cross-site scripting XSS vulnerability in Parental Control -- Access Time Restriction -- Username field, a user cannot delete the rule due to the XSS...

CVE-2021-41946

In FiberHome VDSL2 Modem HG150-UbV3.0, a stored cross-site scripting XSS vulnerability in Parental Control -- Access Time Restriction -- Username field, a user cannot delete the rule due to the XSS...

CVE-2021-41946

In FiberHome VDSL2 Modem HG150-UbV3.0, a stored cross-site scripting XSS vulnerability in Parental Control -- Access Time Restriction -- Username field, a user cannot delete the rule due to the XSS...

Cross site scripting

In FiberHome VDSL2 Modem HG150-UbV3.0, a stored cross-site scripting XSS vulnerability in Parental Control -- Access Time Restriction -- Username field, a user cannot delete the rule due to the XSS...

CVE-2021-41946

CVE-2021-41946 affects FiberHome VDSL2 Modem HG150-Ub_V3.0. The issue is a stored cross-site scripting (XSS) vulnerability in the Parental Control path (Access Time Restriction -> Username field) that prevents deleting a rule due to the XSS. Public references (NVD and Red Hat) document the fla...

CVE-2021-41946

In FiberHome VDSL2 Modem HG150-UbV3.0, a stored cross-site scripting XSS vulnerability in Parental Control -- Access Time Restriction -- Username field, a user cannot delete the rule due to the XSS...

Cybozu Garoon Operation Limit Bypass Vulnerability (CNVD-2022-54299)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. Cybozu Garoon suffers from an Operation Restriction Bypass vulnerability that originates from improper privilege...

Cybozu Garoon Operation Limit Bypass Vulnerability (CNVD-2022-53805)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. Cybozu Garoon suffers from an Operation Restriction Bypass vulnerability that originates from improper privilege...

Cybozu Garoon Operation Limit Bypass Vulnerability (CNVD-2022-53803)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. Cybozu Garoon suffers from an Operation Restriction Bypass vulnerability that originates from improper privilege...

The vulnerability of the Citrix XenMobile Server, a system for managing corporate mobile devices, arises due to an incorrect restriction on the path to the restricted access catalog. This allows a malicious user to execute arbitrary code.

The vulnerability of the Citrix XenMobile Server, a system for managing corporate mobile devices, exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...