Lucene search
+L

3259 matches found

NVD
NVD
•added 2022/09/16 3:15 a.m.•29 views

CVE-2022-36536

An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...

9.8CVSS0.04741EPSS
SaveExploits3References1
Prion
Prion
•added 2022/09/16 3:15 a.m.•25 views

Cross site scripting

Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting XSS vulnerability...

4.9CVSS5.4AI score0.41835EPSS
SaveExploits1References3Affected Software1
CVE
CVE
•added 2022/09/16 2:37 a.m.•96 views

CVE-2022-36536

CVE-2022-36536 affects Syncovery for Linux (Super Flexible Software) in the post_applogin.php component. Multiple sources (NVD, Red Hat, CVE lists) describe an insecure session token generation that enables privilege escalation via crafted tokens in v9.47x and earlier. The published CVSS 3.1 base...

9.8CVSS9.5AI score0.04741EPSS
SaveExploits3References1Affected Software1
Cvelist
Cvelist
•added 2022/09/16 2:37 a.m.•40 views

CVE-2022-36536

An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...

9.7AI score0.04741EPSS
SaveExploits3References1
CVE
CVE
•added 2022/09/16 2:33 a.m.•75 views

CVE-2022-36533

Syncovery for Linux (Super Flexible Software Syncovery, v9.47x and earlier) is affected by an XSS vulnerability caused by missing output encoding on error and status pages, enabling Reflective XSS via a crafted link. Public descriptions confirm exploitable behavior and versions affected up to at ...

5.4CVSS5.3AI score0.41835EPSS
SaveExploits1References1Affected Software1
Cvelist
Cvelist
•added 2022/09/16 2:33 a.m.•34 views

CVE-2022-36533

Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting XSS vulnerability...

5.6AI score0.41835EPSS
SaveExploits1References1
Cvelist
Cvelist
•added 2022/09/16 12:00 a.m.•67 views

CVE-2022-36534

Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain multiple remote code execution RCE vulnerabilities via the JobExecuteBefore and JobExecuteAfter parameters at postprofilesettings.php...

9.4AI score0.52085EPSS
SaveExploits4References2
CVE
CVE
•added 2022/09/16 12:00 a.m.•101 views

CVE-2022-36534

Syncovery for Linux (Syncovery 9, v9.47x and below) contains authenticated remote code execution via Job_ExecuteBefore/Job_ExecuteAfter in post_profilesettings.php. The vulnerability allows an authenticated user to create jobs that execute commands when a profile runs, potentially executing arbit...

8.8CVSS9.2AI score0.52085EPSS
SaveExploits4References2Affected Software1
CNNVD
CNNVD
•added 2022/09/07 12:00 a.m.•13 views

Sophos Firewall SQL注入漏洞

Sophos Firewall is a firewall from Sophos UK. A security vulnerability exists in versions prior to Sophos Firewall v18.5 MR4 18.5.4, which can be exploited by an attacker to escalate privileges from Administrator to Super Administrator...

7.2CVSS7.1AI score0.01144EPSS
SaveExploits0References4
CNNVD
CNNVD
•added 2022/08/29 12:00 a.m.•15 views

Snipe-IT 跨站脚本漏洞

Snipe-IT is an open source IT asset/license management system. A cross-site scripting vulnerability exists in Snipe-IT versions prior to v6.0.11, which originates from a user with Super Administrator privileges being able to implement cross-site scripting via a Markdown Input field...

5.9CVSS6AI score0.00727EPSS
SaveExploits1References3
Openbugbounty
Openbugbounty
•added 2022/08/27 4:47 a.m.•21 views

super-view.com.tw Cross Site Scripting vulnerability OBB-2867499

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

6.2AI score
SaveExploits0
CNVD
CNVD
•added 2022/08/25 12:00 a.m.•19 views

XSS Vulnerability in Beijing Century Super Star Information Technology Development Limited Liability Company's Mobile Library Public Library Version

Mobile Library Public Library Edition is a mobile application personalized for public library patrons. There is an XSS vulnerability in Beijing Century Super Star Information Technology Development Limited Liability Company's Mobile Library Public Map Edition, which can be exploited by attackers ...

5.8AI score
SaveExploits0
CNVD
CNVD
•added 2022/08/25 12:00 a.m.•27 views

Beijing Century Superstar Information Technology Development Co., Ltd.'s Learning Pass suffers from a stored XSS vulnerability

LearningTone is a course learning, knowledge dissemination and management sharing platform built on a microservice architecture. There is a stored XSS vulnerability in Beijing Century Super Star Information Technology Development Limited Liability Company's Learning Pass, which can be exploited b...

5.7AI score
SaveExploits0
CNVD
CNVD
•added 2022/08/25 12:00 a.m.•22 views

XSS Vulnerability in the Mobile Library of Beijing Century Super Star Information Technology Development Co.

Mobile Library is a professional mobile reading software specially made for all libraries. There is an XSS vulnerability in Beijing Century Super Star Information Technology Development Limited Liability Company's Mobile Library, which can be exploited by attackers to obtain sensitive information...

5.8AI score
SaveExploits0
Huntr
Huntr
•added 2022/08/19 4:26 p.m.•61 views

Full account takeover

POC: Step 1: Use a normal user account Step 2: Change user password in edit profile function Step 3: Enter data fields that change normally Step 4: Use burp suite to intercept requests to update profile Step 5: Change id from 2 to id 1 and send request The result of logging in with the new userna...

6.5CVSS0.7AI score0.00879EPSS
SaveExploits1
NVD
NVD
•added 2022/08/15 11:21 a.m.•45 views

CVE-2022-2354

The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should...

7.2CVSS0.01265EPSS
SaveExploits2References1
attackerkb
attackerkb
•added 2022/08/15 12:00 a.m.•5 views

CVE-2022-36803

The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox...

8.8CVSS5.8AI score0.00603EPSS
SaveExploits0References2
OpenVAS
OpenVAS
•added 2022/07/31 12:00 a.m.•16 views

Fedora: Security Advisory for golang-github-tscholl2-siec (FEDORA-2022-37aef44d1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

7.5AI score
SaveExploits0References2
attackerkb
attackerkb
•added 2022/07/27 10:15 a.m.•5 views

CVE-2022-2310

An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of...

10CVSS6AI score0.01201EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
•added 2022/07/27 9:20 a.m.•44 views

CVE-2022-2310 Skyhigh SWG Authentication bypass vulnerability

An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of...

10CVSS9.7AI score0.01201EPSS
SaveExploits0References1
Rows per page
Query Builder