Cross site request forgery (csrf)

The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an api/v1/users/1 request...

Planview Spigit 安全漏洞

Planview Spigit is an innovative management software from Planview USA. A security vulnerability exists in Planview Spigit 4.5.3 in which a REST API allows a remote, unauthenticated attacker to query sensitive user account data...

The vulnerability of the Zabbix universal monitoring system, related to improper cleaning of user data in the “hostinventoriesoverview.php” script, allows a hacker to execute arbitrary SQL commands.

The vulnerability of the Zabbix universal monitoring system is related to improper cleaning of user data in the script “hostinventoriesoverview.php”. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands by sending specially crafted queries remotely...

Fortinet FortiPortal SQL Injection Vulnerability

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines that can be used as a virtual machine for MSPs. vulnerability, which stems from the product's failure to adequately clean...

Session Fixation in projectsend/projectsend

✍️ Description Project Send contains a Session Fixation Vulnerability. This vulnerability is one that can allow an attacker to fixate find or set another person’s session identifier. This most commonly happens when session tokens are now refreshed or renewed when they should be. It looks like the...

Privilege Escalation

webkit2gtk is vulnerable to privilege escalation. The vulnerability exists due to the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure...

GHSA-RGCM-RPQ9-9CGR Missing Authentication for Critical Function in Saleor

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

Missing Authentication for Critical Function in Saleor

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

NCH WebDictate Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in NCH WebDictate, a web-based dictation recording, editing, and management software, which stems from a failure of the product's Recipient Name field to properly validate user data, which could be exploited to add or modify affected fields...

Siemens Solid Edge Heap Buffer Overflow Vulnerability

Siemens Solid Edge is a group of software tools for dealing with various product development processes: 3D design, simulation, manufacturing and design management. A heap buffer overflow vulnerability exists in Siemens Solid Edge. In the affected application, the PLMXMLADATESE70.DLL library lacks...

Siemens Solid Edge Heap Buffer Overflow Vulnerability (CNVD-2021-51463)

Siemens Solid Edge is a group of software tools for dealing with various product development processes: 3D design, simulation, manufacturing and design management. Siemens Solid Edge heap buffer overflow vulnerability. The vulnerability is due to a lack of proper validation of user-supplied data ...

Siemens Solid Edge Heap Buffer Overflow Vulnerability (CNVD-2021-51465)

Siemens Solid Edge is a group of software tools for dealing with various product development processes: 3D design, simulation, manufacturing and design management. A heap buffer overflow vulnerability exists in Siemens Solid Edge. In the affected application, the PLMXMLADATESE70.DLL library lacks...

Siemens JT2Go and Teamcenter Visualization out-of-bounds write vulnerability (CNVD-2021-51468)

Siemens Jt2go is a JT file viewer.Siemens Teamcenter Visualization is a software that provides teamwork capabilities for designing 2D and 3D scenarios. An out-of-bounds write vulnerability exists in Siemens JT2Go versions prior to 13.2 and Teamcenter Visualization versions prior to 13.2. The...

Siemens Solid Edge Heap Buffer Overflow Vulnerability (CNVD-2021-51464)

Siemens Solid Edge is a group of software tools for dealing with various product development processes: 3D design, simulation, manufacturing and design management. A heap buffer overflow vulnerability exists in Siemens Solid Edge where the plmxmlAdapterSE70.dll library in the affected application...

IBM Cloud Pak for Applications Cross-Site Scripting Vulnerability (CNVD-2022-05118)

IBM Cloud Pak for Applications is an application from IBM USA, Inc. A cross-site scripting vulnerability exists in IBM Cloud Pak for Applications, which stems from the product's lack of validation of user-side data, and could be exploited by an attacker to execute client-side code and potentially...

CVE-2021-34308

A vulnerability has been identified in JT2Go All versions V13.2, Teamcenter Visualization All versions V13.2. The BMPLoader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out of bounds read past the end of an...

IBM Cloud Pak for Applications 跨站脚本漏洞

IBM Cloud Pak for Applications is an application from IBM USA, Inc. A cross-site scripting vulnerability exists in IBM Cloud Pak for Applications, which stems from the product's lack of validation of user-side data, and could be exploited by an attacker to execute client-side code and potentially...

The Latest Pro-Trump Twitter Clone Leaks User Data on Day 1

Plus: A failed takedown in Russia, details on an FBI-sting encrypted phone, and more of the week's top security news...

Zoo Management System 1.0 Cross Site Scripting

Exploit Title: Zoo Management System 1.0 - 'Multiple' Stored Cross-Site-Scripting XSS Date: 08/07/2021 Exploit Author: Subhadip Nag Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/zoo-management-system-using-php-and-mysql/ Version: 1.0 Tested on: Server: XAMPP...

Zoo Management System 1.0 - (Multiple) Stored Cross-Site-Scripting Vulnerability

Exploit Title: Zoo Management System 1.0 - 'Multiple' Stored Cross-Site-Scripting XSS Exploit Author: Subhadip Nag Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/zoo-management-system-using-php-and-mysql/ Version: 1.0 Tested on: Server: XAMPP Description Zoo...