Yelp: CORS Misconfiguration on trust.yelp.com

Summary: An cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of th...

CVE-2022-39030

smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information...

Authorization

Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to access the information, can access sensitive information...

CVE-2022-39030 Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2

smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information...

CVE-2022-32805

The issue was addressed with improved handling of caches. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to access sensitive user information...

Design/Logic Flaw

The issue was addressed with improved handling of caches. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to access sensitive user information...

CVE-2022-32805

The issue was addressed with improved handling of caches. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to access sensitive user information...

CVE-2022-32849

An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to access sensitive user information...

CVE-2022-36867

Improper access control vulnerability in Editor Lite prior to version 4.0.40.14 allows attackers to access sensitive information...

CVE-2022-36867

Improper access control vulnerability in Editor Lite prior to version 4.0.40.14 allows attackers to access sensitive information...

Design/Logic Flaw

A local file inclusion LFI vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service DoS or access sensitive server information via manipulation of the getpage parameter in a crafted web request...

CVE-2022-33916

OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information...

macOS 11.x < 11.6.8 (HT213344)

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.6.8 Big Sur. It is, therefore, affected by multiple vulnerabilities : - An out-of-bounds write issue vulnerability may lead to arbitrary code execution. CVE-2022-32787 - Exploitation of this vulnerability may lead t...

CVE-2022-35980 OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features...

CVE-2022-20869 Cisco BroadWorks Application Delivery Platform Software Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. This vulnerability exists because the web-based management...

Expression Language Injection

Expression Language EL has been defined as part of the Java Server Pages Standard Tag Library JSTL in order to offer developers a simple way to output data from an object model. Starting from the JSP 2.0 specification, Expression Language has been made available within JSP pages, but it is also...

PT-2022-23297 · Bf-Os · Bf-Os

Name of the Vulnerable Software and Affected Versions: BF-OS versions 3.00 through 3.83 Description: The issue allows an attacker to modify the file path, potentially accessing different resources that may contain sensitive information. Recommendations: For BF-OS versions 3.00 through 3.83,...

CVE-2022-36302: Improper Restriction of Names for Files and Other Resources

File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access different resources, which may contain sensitive information...

Adobe Acrobat and Adobe Acrobat Reader Buffer Overflow Vulnerability

Adobe Acrobat and Adobe Acrobat Reader are both products of the United States Ordoby Adobe.Adobe Acrobat is a set of PDF file editing and conversion tools.Adobe Acrobat Reader is a PDF viewer. The software is used to print, sign and annotate PDF. Adobe Acrobat and Adobe Reader has a buffer overfl...

Information leakage vulnerability in webpage anti-tampering system of Beijing Netnifty Nebula Information Technology Co., Ltd (CNVD-2022-59144)

Beijing NetGuard Nebula Information Technology Company is a leading enterprise in the domestic information security industry, specializing in the research and development, production and sales of information security products. There is an information leakage vulnerability in the webpage...