多款VMware产品授权问题漏洞

VMware vRealize Automation and others are products of VMware, Inc. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vMware Workspace One Access is a centralized management console that enables you to manage users and groups, set and manage...

EUVD-2022-6344

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents...

PT-2022-20575 · Jquery +5 · Jquery Ui +5

Name of the Vulnerable Software and Affected Versions: jQuery UI versions prior to 1.13.2 Moodle versions prior to 3.11.17-alt1 Description: jQuery UI, a collection of user interface interactions, effects, widgets, and themes built on jQuery, is susceptible to a cross-site scripting XSS issue...

CVE-2022-22477

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

PT-2022-3256 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.0.0 through 2.4.0 Argo CD versions 2.1.0 through 2.1.15 Argo CD versions 2.2.0 through 2.2.9 Argo CD versions 2.3.0 through 2.3.4 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The...

PT-2022-6774 · Google +1 · Google Chrome +1

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 102.0.5005.61 Description: The issue is related to a use after free in the UI of Google Chrome, which allows a remote attacker to perform arbitrary read/write via a crafted HTML page. This can potentially enabl...

Information disclosure

Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope...

The vulnerability of the Cast UI interface in Google Chrome and Microsoft Edge browsers allows a hacker to execute arbitrary code.

The vulnerability of the Cast UI interface in Google Chrome and Microsoft Edge is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2022-8044 · Unknown · Swagger-Ui

Name of the Vulnerable Software and Affected Versions: Swagger UI versions 4.1.2 and earlier Description: The issue allows a remote attacker to conduct spoofing attacks by persuading a victim to open a crafted URL, which could exploit this vulnerability to display remote OpenAPI definitions...

CVE-2021-36326

Dell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip Vulnerability in the User Interface UI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to a downgrade in the communications between the client and server into an unencrypted forma...

Apache ShardingSphere 代码问题漏洞

Apache ShardingSphere, an open source distributed database middleware solution from the Apache Foundation, has a security vulnerability in the Apache ShardingSphere UI that stems from insecure deserialization of serialized data received by the application from users, which could be exploited by a...

Huawei Emui and Magic UI Public Key Authentication Vulnerability

Huawei Emui is a mobile operating system developed based on Android.Magic Ui is a mobile operating system developed based on Android. A security vulnerability exists in Huawei Emui and Magic Ui. An attacker could exploit the vulnerabilities to compromise service confidentiality...

CVE-2021-35570

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Admin UI. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2021-41861

The Red Hat and NVD entries describe CVE-2021-41861 as a vulnerability in Telegram for Android (versions 7.5.0–7.8.0) where image self-destruction is not properly implemented. After roughly two to four uses of the self-destruct feature, the UI misleadingly indicates that an image was deleted, but...

CVE-2021-34765

A vulnerability in the web UI for Cisco Nexus Insights could allow an authenticated, remote attacker to view and download files related to the web application. The attacker requires valid device credentials. This vulnerability exists because proper role-based access control RBAC filters are not...

CVE-2021-1582

A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller APIC or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability is due to improper input validation in the web UI. A...

IBM Jazz Foundation Cross-Site Scripting Vulnerability (CNVD-2021-88199)

IBM Jazz Foundation is a next-generation collaboration platform for software delivery technologies from IBM. A cross-site scripting vulnerability exists in IBM Jazz Foundation and IBM Engineering. An attacker could exploit the vulnerability to embed arbitrary JavaScript code in the Web UI to chan...

Cisco Integrated Management Controller Command Injection (cisco-sa-CIMC-CIV-pKDBe9x5)

According to its self-reported version, Cisco Integrated Management Controller IMC is affected by a vulnerability in the web UI that allows an authenticated, remote attacker to inject arbitrary code and execute arbitrary commands at the underlying operating system level. The vulnerability is due ...

CVE-2021-32719

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the rabbitmqfederationmanagement plugin, its consumer tag was rendered without proper tag sanitization. This potentially allows for...

CVE-2021-32719

CVE-2021-32719 affects RabbitMQ’s rabbitmq-server prior to version 3.8.18 where, when a federation link is shown in the management UI via the rabbitmq_federation_management plugin, the consumer tag is rendered without proper [removed] tag sanitization. This could allow JavaScript execution in the...