Input validation

Improper input validation for some IntelR PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via network access...

Cross site scripting

Out of bounds read for some IntelR PROSet/Wireless WiFi and KillerTM WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacent access...

CVE-2022-30296

Insufficiently protected credentials in the IntelR Datacenter Group Event iOS application, all versions, may allow an unauthenticated user to potentially enable information disclosure via network access...

CVE-2022-21197

Improper input validation for some IntelR PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via network access...

CVE-2021-23168

Out of bounds read for some IntelR PROSet/Wireless WiFi and KillerTM WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacent access...

CVE-2021-23168

Out of bounds read for some IntelR PROSet/Wireless WiFi and KillerTM WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacent access...

EulerOS 2.0 SP5 : 389-ds-base (EulerOS-SA-2022-2264)

According to the versions of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that...

Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS

The plugin does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it. As an...

Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls

The plugin is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors reporter by the submitter or update arbitrary order status identified by WPScan when verifying the issue for example. Other...

CVE-2022-35487

Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files...

Unauthenticated Path Traversal

Description A unauthenticated user can read and download files of the application system by abusing the filename parameter, of the /api/image/cover-uploadendpoint, that is not properly sanitized. Proof of Concept 1 - Send the following request, where the filename has the relative path of the targ...

CVE-2021-38417

VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing...

Improper access control

VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing...

CVE-2022-40626

An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend...

GitHub: DoS via markdown API from unauthenticated user

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the...

Updated 389-ds-base packages fix security vulnerability

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows...

Design/Logic Flaw

A vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an administrator without needing to be authenticated...

WordPress Events Made Easy plugin SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. versions of the WordPress Events Made Easy plugin prior to 2.2.81 are vulnerable to SQL injection...

CVE-2022-27511

CVE-2022-27511 affects Citrix Application Delivery Management (ADM). A remote, unauthenticated attacker could leverage an improper access-control flaw to reset the administrator password at the next device reboot, enabling access via SSH with default credentials. Patched versions exist (Citrix AD...

CVE-2022-27511 Corruption of the system by a remote, unauthenticated user potentially leading to the reset of the administrator password

Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, allowing an attacker with ssh access to connect with the default administrator credentials after the device has rebooted...