DRUPAL-CONTRIB-2022-029

This module is used as part of the Opigno LMS distribution and implements learning paths for the LMS. The module was providing too much user information about users such as the list of groups a uid is in...

CVE-2022-22985 ICSA-22-062-01 IPCOMM ipDIO

The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the specific web section where the information is displayed. Injection can be done on specific...

CVE-2022-26317

A vulnerability has been identified in Mendix Applications using Mendix 7 All versions V7.23.29. When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was initially made by the user requesting the result. Together with...

PeTeReport Cross-Site Scripting Vulnerability

PeTeReport is an open source application vulnerability reporting tool. PeTeReport has a cross-site scripting vulnerability that stems from the software's lack of filtering and escaping of user data, which could be exploited by an attacker to inject persistent JavaScript code through an...

PeTeReport Cross-Site Scripting Vulnerability (CNVD-2022-23466)

PeTeReport is an open source application vulnerability reporting tool. Designed to assist penetration testing/red team efforts by simplifying the task of report writing and generation, PeTeReport version 0.5 contains a cross-site scripting vulnerability that stems from the software's lack of...

PeTeReport 跨站脚本漏洞

PeTeReport is an open source application vulnerability reporting tool. Designed to assist penetration testing/red team efforts by simplifying the task of report writing and generation, PeTeReport version 0.5 contains a cross-site scripting vulnerability that stems from the software's lack of...

Dolibarr 安全漏洞

Dolibarr is a software application. A modern software package that helps manage your organization's activities. A security vulnerability exists in Dolibarr versions prior to 15.0.1, which stems from the lack of handling of user-submitted data in the software and can be exploited by an attacker to...

PT-2022-17702 · Unknown · Ametys Cms

Name of the Vulnerable Software and Affected Versions: Ametys CMS versions prior to 4.5.0 Description: The auto-completion plugin in Ametys CMS allows a remote unauthenticated attacker to read documents, which contain all characters typed by all users, including the content of private pages. Thes...

Accounting Journal Management Cross-Site Scripting Vulnerability

Accounting Journal Management is a simple PHP-based accounting journal management system with a trial balance. accounting Journal Management version 1.0 is vulnerable to a cross-site scripting vulnerability that stems from a lack of filtering of user-supplied data and The vulnerability is caused ...

Zenly Social-Media App Bugs Allow Account Takeover

Zenly, a social app from Snap that allows users to see the locations of friends and family on a live map, contains a pair of vulnerabilities that could endanger those being tracked. According to the Checkmarx Security Research Team, the bugs are a user-data exposure vulnerability and an...

Missing server signature validation in OctoberCMS

Impact This advisory affects authors of plugins and themes listed on the October CMS marketplace where an end-user will inadvertently expose authors to potential financial loss by entering their private license key into a compromised server. It has been disclosed that a project fork of October CM...

Security Updates for Microsoft Office Products (February 2022) (macOS)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2022-22003 - A information disclosure...

Cookie Information < 2.0.8 - Reflected Cross-Site Scripting

The plugin does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=wp-gdpr-compliance=%27+onanimationstart%3Dalert%28/XSS/%29+style%3Danimation-name%3Arotation+x...

Google Bringing Privacy Sandbox to Android to Limit Sharing of User Data

Google on Wednesday announced plans to bring its Privacy Sandbox initiatives to Android in a bid to expand its privacy-focused, but also less disruptive, advertising technology beyond the desktop web. To that end, the internet giant said it will work towards building solutions that prevent...

Sangoma Technologies Corporation Switchvox 信息泄露漏洞

Sangoma Technologies Switchvox is a phone system for businesses of any size from Sangoma Technologies Corporation of Canada. An information disclosure vulnerability exists in Sangoma Technologies Corporation Switchvox that stems from the product not adding a valid access restriction to...

Cross-site Scripting (XSS) - Reflected in cortezaproject/corteza-server

Description The logout function doesn't clean/filter value of "back" parameter before reflecting into html code leading to Reflected XSS vulnerability. Proof of Concept Visit URL: https://latest.cortezaproject.org/auth/logout?back=%22%3E%3Cscript%3Ealertorigin%3C/script%3E%3C%22 Poc:...

Foxit PDF Reader 缓冲区错误漏洞

Foxit PDF Reader is a PDF reader from Foxit China. A security vulnerability exists in Foxit PDF Reader, which stems from a lack of proper validation of user-supplied data, which could result in reading beyond the end of the allocated object, and could be exploited by an attacker to execute...

CVE-2022-22534

Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the...

CVE-2022-23331

In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password...

GHSA-V84G-CF5J-XJQX Path Traversal in Apache James Server

Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users...