2718 matches found
CVE-2022-4223
CVE-2022-4223 describes a remote code execution vulnerability in pgAdmin that affects versions prior to 6.17. An insecure HTTP API allows an unauthenticated user to pass a manipulated path (e.g., a UNC path) to the server, which could lead to the execution of an arbitrary executable on the pgAdmi...
PT-2022-28004 · Websoft · Websoft Hcm
Name of the Vulnerable Software and Affected Versions: WebSoft HCM version 2021.2.3.327 Description: Insufficient processing of user input in WebSoft HCM allows an unauthenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the...
Debian DSA-5298-1 : cacti - security update
The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5298 advisory. - Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. CVE-2022-0730 - Cacti is an open source platform which provid...
WP User <= 7.0 - Unauthenticated SQLi
The plugin does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. PoC 1. As an unauthenticated user, visit the "Sign Up" page by default, this is /?pageid=5, or /user/ 2. Extract the...
Sensitive system information disclosure
Description An unauthenticated user can gather information on the remote system just by visiting the following endpoints: + /library/exten-radiusserverinfo.php which reveals pieces of information such as system uptime, CPU load, etc. + /library/exten-serverinfo.php which reveals if mysql and/or...
CVE-2022-46169
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data...
CVE-2022-46169
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data...
CVE-2022-46169 Unauthenticated Command Injection
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data...
CVE-2022-46169 Unauthenticated Command Injection
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data...
CVE-2022-0698
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter...
Design/Logic Flaw
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter...
CVE-2022-0698
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter...
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
The plugin does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE PoC 1. As an unauthenticated user, navigate to the main WordPress page 2. Extract a valid nonce from the page source CTRL+F for "var wpdevart =", field...
CVE-2022-38755
Vulnerability summary (CVE-2022-38755) : Micro Focus Filr versions prior to 4.3.1.1 are affected by a remote, unauthenticated user-enumeration flaw. Attackers can enumerate valid user accounts without authentication. The issue is confirmed across multiple sources (NVD/Red Hat/ CVE listings). Impa...
F-Secure Policy Manager 安全漏洞
F-Secure Policy Manager is an enterprise security solution from Finnish company F-Secure. A security vulnerability exists in F-Secure Policy Manager that originates from a file whose contents can be written in any location by an unauthenticated user, which can be exploited by an attacker to write...
CVE-2022-38165
Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on the F-Secure Policy Manager Server...
FreeBSD : Grafana -- Privilege escalation (db895ed0-6298-11ed-9ca2-6c3be5272acd)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db895ed0-6298-11ed-9ca2-6c3be5272acd advisory. - Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and...
CVE-2022-33942
Protection mechanism failure in the IntelR DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...