9966 matches found
Design/Logic Flaw
An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...
CVE-2021-43287
An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...
PT-2022-15284 · Juniper Networks · Junos Evolved
Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS Evolved versions 20.4 prior to 20.4R3-S2-EVO Juniper Networks Junos OS Evolved versions 21.1 prior to 21.1R3-S1-EVO Juniper Networks Junos OS Evolved versions 21.2 prior to 21.2R3-EVO Juniper Networks Junos OS Evolve...
CVE-2022-20735
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management...
CVE-2022-22562
Dell PowerScale OneFS, versions 8.2.0-9.3.0, contain a improper handling of missing values exploit. An unauthenticated network attacker could potentially exploit this denial-of-service vulnerability...
CVE-2022-27480
A vulnerability has been identified in SICAM A8000 CP-8031 All versions V4.80, SICAM A8000 CP-8050 All versions V4.80. Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenticated attackers to download these files...
SAPUI5 library 跨站脚本漏洞
SAP SAPUI5 library is a JavaScript application framework from SAP, a German company. SAP SAPUI5 library is vulnerable to cross-site scripting, which can be exploited by unauthenticated attackers to execute JavaScript code on the client side...
SAP NetWeaver ABAP Server 输入验证错误漏洞
SAP Netweaver is a set of integrated service-oriented application platforms from SAP, Germany. SAP NetWeaver ABAP Server and ABAP Platform is vulnerable to user redirection, which can be exploited by unauthenticated attackers to trick users into disclosing personal information...
Zoho ManageEngine ADAudit Plus Remote Code Execution Vulnerability
Zoho ManageEngine Adaudit Plus, from Zoho Corporation, is used to simplify auditing, prove compliance, and detect threats. remote code execution vulnerability exists in versions of Zoho ManageEngine ADAudit Plus prior to 7060, which can be exploited by unauthenticated attackers to remote code...
CVE-2022-20774
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against a user of the web-based interface of an affected system. This...
CVE-2020-22253
CVE-2020-22253 affects Xiongmai Technology Co devices including AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, and HI3518E_50H10L_S39. The root cause described across sources is an open port 9530 on these devices, which allows unauthentica...
ZOHO ManageEngine ADAudit Plus 代码问题漏洞
Zoho ManageEngine Adaudit Plus, from Zoho Corporation, is used to simplify auditing, prove compliance, and detect threats. remote code execution vulnerability exists in versions of Zoho ManageEngine ADAudit Plus prior to 7060, which can be exploited by unauthenticated attackers to remote code...
WordPress Title Experiments Free plugin SQL注入漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Title Experiments Free plugin version 9.0.1 prior to the SQL injection vulnerability, the vulnerability stems from the use o...
Cab fare calculator < 1.0.4 - Unauthenticated LFI
The plugin does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues. Despite what the original advisory claims, the issue is not exploitable by accessing the file directly as a fatal error is triggered before the vulnerable...
Incorrect Access Control in ImpressCMS
ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers who are, by design, able to have a security token...
Textpattern CMS 跨站脚本漏洞
Textpattern CMS is a Php-based content management system from the Textpattern team. textpattern is vulnerable to cross-site scripting, which can be exploited by unauthenticated remote attackers to trigger remote code execution using XSS by uploading a webshell...
CVE-2022-0833
The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file...
Cross site request forgery (csrf)
The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file...