244 matches found
CVE-2023-43763
Certain WithSecure products allow XSS via an unvalidated parameter in the endpoint. This affects WithSecure Policy Manager 15 on Windows and Linux...
Code injection
Certain WithSecure products allow XSS via an unvalidated parameter in the endpoint. This affects WithSecure Policy Manager 15 on Windows and Linux...
CVE-2023-43763
CVE-2023-43763 affects WithSecure Policy Manager 15 on Windows and Linux. The issue—an XSS vulnerability—stems from an unvalidated parameter in a web endpoint, indicating insufficient input validation in the affected component. The CVSS 3.1 base score is 6.1 (MEDIUM) with Network access, Low conf...
Connect IQ 安全漏洞
Connect IQ CIQ is a technology platform and ecosystem from Garmin Switzerland designed to extend and customize the functionality of its smartwatches and health trackers. Connect IQ suffers from a security vulnerability that stems from an unvalidated API function parameter that results in a buffer...
Connect IQ 安全漏洞
Connect IQ CIQ is a technology platform and ecosystem from Garmin Switzerland designed to extend and customize the functionality of its smartwatches and health trackers. Connect IQ suffers from a security vulnerability that stems from an unvalidated API function parameter that results in a buffer...
Connect IQ 输入验证错误漏洞
Connect IQ CIQ is a technology platform and ecosystem from Garmin Switzerland designed to extend and customize the functionality of its smartwatches and health trackers. Connect IQ suffers from a security vulnerability that stems from an unvalidated parameter in an API function that results in an...
Companymaps 8.0 Cross Site Scripting Vulnerability
Exploit Title: Reflected Cross Site Scripting - Exploit Author: Lucas Noki 0xPrototype - Vendor Homepage: https://github.com/vogtmh - Software Link: https://github.com/vogtmh/cmaps - Version: 8.0 - Tested on: Mac, Windows, Linux - CVE : CVE-2023-29808 Description: The vulnerability found is...
PT-2023-5835 · Inductive Automation · Inductive Automation Ignition
Name of the Vulnerable Software and Affected Versions: Inductive Automation Ignition affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this...
SUSE CVE-2011-2022
The agpgenericremovememory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 does not validate a certain start parameter, which allows local users to gain privileges or cause a denial of service system crash via a crafted AGPIOCUNBIND agpioctl ioctl call, a different...
PT-2023-14443 · Cloudflare · Warp Client
Name of the Vulnerable Software and Affected Versions: WARP client affected versions not specified Description: The support uri parameter in the WARP client local settings file mdm.xml lacked proper validation, allowing for privilege escalation and launching an arbitrary executable on the local...
CVE-2022-42753
SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks...
PT-2022-24249 · F Secure · F-Secure Policy Manager
Name of the Vulnerable Software and Affected Versions: WithSecure versions prior to 2022-08-10 Description: The issue is related to reflected cross-site scripting XSS vulnerabilities due to an unvalidated parameter in an endpoint, allowing remote attackers to provide malicious input. This affects...
Wedding Planner SQL注入漏洞
Wedding Planner is a wedding planner project by pushpam abhishek. Designed to provide users with an easy way to plan their wedding through a web application while using real data. Wedding Planner v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of the id...
YetiForceCrm 跨站脚本漏洞
YetiForceCrm is an open source Crm system from the Polish company YetiForce. A cross-site scripting vulnerability exists in YetiForceCrm versions prior to 6.4.0, which stems from an unvalidated recordModel-name parameter of type "Text" in the SlaPolicy module in Settings and is used directly in...
Tenda AX1806 缓冲区错误漏洞
Tenda AX1806 is a WiFi6 wireless router from Tenda, China. Tenda AX1806 V1.0.0.1 is vulnerable to a stack overflow vulnerability that stems from the list parameter in the formSetQosBand function not checking its length for input data. An attacker could exploit this vulnerability to cause a denial...
Online Fire Reporting System SQL注入漏洞
Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which stems from a GET parameter in /report/list.php that lacks validation for external The vulnerability is caused...
Badminton Center Management System SQL注入漏洞
Badminton Center Management System is a badminton center management system from Carlo Montero's personal developer. It provides an online and automated platform for badminton centers to manage their daily transactions and records. Badminton Center Management System v1.0 version has a SQL injectio...
CSCMS Music Portal System SQL注入漏洞
CSCMS Music Portal System is a diversified content management system of China Chong Sheng Network Technology CSCMS Company. CSCMS Music Portal System suffers from a SQL injection vulnerability that originates from the lack of validation of the id parameter in /admin.php/vod/admin/topic/del for...
CVE-2022-1560
The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal err...
CVE-2022-1560
The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal err...