56 matches found
CVE-2024-8309
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tenant securit...
CVE-2023-3290
A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...
CVE-2023-3285 A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0
A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...
CVE-2023-3285 A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0
A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...
GHSA-2M5G-8XPW-42VP OpenCFP Framework (Sentry) Account takeover via null password reset codes
OpenCFP, an open-source conference talk submission system written in PHP, contains a security vulnerability in its third-party authentication framework, Sentry, developed by Cartalyst. The vulnerability stems from how Sentry handles password reset checks. Users lacking a password reset token stor...
CVE-2024-31985
XWiki Platform CSRF in the Job Scheduler (CVE-2024-31985) affects 3.1+ up to before 4.10.20, 15.5.4, and 15.10-rc-1 where an admin visiting the Job Scheduler page via a predictable URL (e.g., embedded in content) can schedule/trigger/unschedule existing jobs. The issue arises from CSRF allowing u...
Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
Impact You can create, delete etc. tags without having the permission to do so. This vulnerability allows an attacker to perform broken access control and add tags to admin panel and add dumy data. One can do this as intruder and add text parameters with random numbers and this will effect...
CVE-2024-24822 Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually...
Moxa ioLogik 4000 Series Incorrect Authorization (CVE-2023-4227)
A vulnerability has been identified in the ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of...
CVE-2023-35164 Unauthorized users can manipulate a dashboard created by an administrator in DataEase
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a missing authorization check allows unauthorized users to manipulate a dashboard created by the administrator. This vulnerability has been fixed in version...
Sielco Radio Link 2.06 Improper Access Control
!-- This will set/modify user1 p...
CVE-2023-22807 CVE-2023-22807
LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol...
CVE-2022-41714 fastest-json-copy 1.0.1 - Prototype Pollution
fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the 'proto' property to be edited...
Design/Logic Flaw
Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services for Microsoft...
CVE-2021-22648
Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file...
Functions in OperatorSripts.sol can be called by anyone
Lines of code Vulnerability details Impact The functions defined in OperatorScripts contract are external functions without any other access control. So anyone can add operators for OperatorResolver.getOpertor which is called in MixinOperatorResolver to use in callOperator, which is called when...
CVE-2021-44857
A flaw was found in mediawiki. The "mcrundo" and "mcrrestore" actions action=mcrundo and action=mcrrestore did not properly check for editing permissions and allowed an attacker to take the content of any arbitrary revision and save it on any page of their choosing. This affects both public wikis...
CVE-2021-31894
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier All versions, SIMATIC PCS 7 V9.X All versions V9.1 SP2, SIMATIC PDM All versions V9.2 SP2, SIMATIC STEP 7 V5.X All versions V5.7, SINAMICS STARTER containing STEP 7 OEM version All versions V5.4 SP2 HF1. A directory containing...
Design/Logic Flaw
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier All versions, SIMATIC PCS 7 V9.X All versions V9.1 SP2, SIMATIC PDM All versions V9.2 SP2, SIMATIC STEP 7 V5.X All versions V5.7, SINAMICS STARTER containing STEP 7 OEM version All versions V5.4 SP2 HF1. A directory containing...