Design/Logic Flaw

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposed when a Network is sniffed. Affected Product: Conext? ComBox All Versions...

CVE-2021-22798

The CVE-2021-22798 issue affects Schneider Electric Conext ComBox (All Versions) and is described as CWE-522: Insufficiently Protected Credentials. The vulnerability could allow exposure of sensitive data (e.g., login credentials) when a network is sniffed. Root cause: credentials are not adequat...

Schneider Electric Conext™ComBox 安全漏洞

The Schneider Electric Conext ComBox is a powerful communication and monitoring device from Schneider Electric France. A security vulnerability exists in the Schneider Electric Conext™ ComBox that stems from the presence of an insufficiently protected credentials vulnerability that could result i...

CVE-2022-22534

Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the...

Design/Logic Flaw

Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the...

CVE-2022-22534

Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the...

CVE-2022-0536

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8...

UBUNTU-CVE-2022-0536

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8...

PT-2022-13247

Name of the Vulnerable Software and Affected Versions NPM follow-redirects versions prior to 1.14.8 Description The issue is related to the improper removal of sensitive information before storage or transfer, which can lead to exposure of sensitive information to unauthorized actors...

PT-2022-15504 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver affected versions not specified Description: The issue is caused by insufficient encoding of user input, allowing an unauthenticated attacker to inject code. This can expose sensitive data, such as user id and password. The...

Servisnet Tessa 安全漏洞

Servisnet Tessa is a web application from Servisnet Turkey. A security vulnerability exists in Servisnet Tessa version 0.0.2, which stems from a lack of effective information protection in app.js. The vulnerability can be exploited by an attacker to obtain sensitive information via a /js/app.js...

Schneider Electric 多款产品跨站请求伪造漏洞

Schneider Electric Modicon Quantum and others are products of Schneider Electric, France.Schneider Electric Modicon Quantum is a large programmable logic controller PLC for process applications, high availability and safety solutions.Schneider Electric Modicon M340 is a mid-range PLC programmable...

Improper Authorization in phpipam/phpipam

Description In phpIPAM 1.4.5, a normal user with the role of Usercould view/read the log files via show-logs.php, errorlogs.php and accesslogs.php endpoints. It is supposedly accessible by the Administrator only. Proof of Concept Tested version: phpIPAM 1.4.5 Affected endpoints: 1 GET/POST...

CVE-2021-44866

An issue was discovered in Online-Movie-Ticket-Booking-System 1.0. The file about.php does not perform input validation on the 'id' paramter. An attacker can append SQL queries to the input to extract sensitive information from the database...

CVE-2021-22825

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system with elevated privileges when a privileged account clicks on a malicious URL that compromises the security token. Affected Products: AP7xxxx and AP8xxx with...

PT-2022-12274 · Tenda · Tenda Ac15 +1

Name of the Vulnerable Software and Affected Versions: Tenda devices, such as AC15V1.0 version V15.03.05.20 multi and AC5V1.0 version V15.03.06.48 multi Description: The issue allows an attacker to bypass authentication, potentially obtaining sensitive information. This can be combined with...

CVE-2021-44794

Single Connect does not perform an authorization check when using the "sc-diagnostic-ui" module. A remote attacker could exploit this vulnerability to access the device information page. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information...

Ninjasworkout - Vulnerable NodeJS Web Application

Damn Vulnerable NodeJS Application Quick Start Download the Repo = run npm i Afer Installing all dependency just run the application node app.js or nodemon app.js ADDED BUGS Prototype Pollution No SQL Injection Cross site Scripting Broken Access Control Broken Session Management Weak Regex...

CVE-2021-46385

https://gitee.com/mingSoft/MCMS MCMS =5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information remote. The component is: net.mingsoft.mdiy.action.FormDataActionqueryData. The attack vector is: 0 or sleep3. ¶¶ MCMS has a sql injection vulnerability through which attacker ca...

CVE-2020-4875

IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 190838...