CVE-2022-36521

Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts...

Code injection

Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts...

CVE-2022-36521

CVE-2022-36521 affects cskefu v7.0.1, where insecure permissions allow unauthenticated attackers to arbitrarily add administrator accounts. The issue is rooted in permission checks within the application, enabling privilege escalation at the admin-creation step. Multiple sources (NVD/Red Hat/CVE ...

CVE-2022-36521

Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts...

59sec LITE <= 3.4.1 - Unauthenticated Settings Update

Description The plugin does not have any authorisation in place when updating its settings, allowing unauthenticated attackers to do so...

CVE-2022-35203

An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information...

CVE-2022-35203

CVE-2022-35203 concerns TrendNet TV-IP572PI v1.0 with an access control flaw that allows unauthenticated attackers to access sensitive system information. Root cause: improper access control. Impact: exposure of sensitive system data. Public details indicate exploitation specifics are not provide...

CVE-2022-35203

An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information...

CVE-2022-2276

CVE-2022-2276 affects the WordPress plugin WP Edit Menu (versions prior to 1.5.0). The issue is a lack of authorization and CSRF protection in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts or pages from a blog. The core impact is unauthorized post/page dele...

CVE-2022-36883

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit...

Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Deletion

The plugin does not have any authorisation and CSRF checks in place when deleting events which could allow unauthenticated attackers to delete arbitrary events PoC As an unauthenticated user, open the code below, this will delete the event with ID 4 from the calendar with ID 1...

CVE-2022-2846

The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and...

Cross site scripting

The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and...

CVE-2022-38193

There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution...

CVE-2022-2846

The CVE-2022-2846 concerns the Calendar Event Multi View WordPress plugin prior to version 1.4.07. Root cause: missing authorization, CSRF protections, and insufficient sanitisation/escaping in event creation fields. Impact: unauthenticated attackers can create arbitrary events and inject Cross-S...

Esri Portal For ArcGis 跨站脚本漏洞

Esri Portal For ArcGis is a component of Esri, Inc. that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A security vulnerability exists in Esri Portal For ArcGis, which stems from stored cross-site scripting XSS in configurable...

CVE-2022-36923

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...

CVE-2022-36923

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...

CVE-2022-36923

CVE-2022-36923 affects Zoho ManageEngine products (OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils) with an authentication bypass that allows an unauthenticated attacker to retrieve a user’s API key and use external APIs. T...

Zoho Password Manager Pro XML-RPC Java Deserialization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zoho Password Manager Pro XML-RPC Java Deserialization', 'Description' = %q This module exploits a Java deserialization vulnerability in Zoho...