CVE-2022-26317

A vulnerability has been identified in Mendix Applications using Mendix 7 All versions V7.23.29. When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was initially made by the user requesting the result. Together with...

PeTeReport Cross-Site Scripting Vulnerability

PeTeReport is an open source application vulnerability reporting tool. PeTeReport has a cross-site scripting vulnerability that stems from the software's lack of filtering and escaping of user data, which could be exploited by an attacker to inject persistent JavaScript code through an...

PeTeReport Cross-Site Scripting Vulnerability (CNVD-2022-23466)

PeTeReport is an open source application vulnerability reporting tool. Designed to assist penetration testing/red team efforts by simplifying the task of report writing and generation, PeTeReport version 0.5 contains a cross-site scripting vulnerability that stems from the software's lack of...

PeTeReport Cross-Site Scripting Vulnerability

PeTeReport is an open source application vulnerability reporting tool. Designed to assist penetration testing/red team efforts by simplifying the task of report writing and generation, PeTeReport version 0.5 contains a cross-site scripting vulnerability that stems from the software's lack of...

Dolibarr security vulnerabilities

Dolibarr is a software application. A modern software package that helps manage your organization's activities. A security vulnerability exists in Dolibarr versions prior to 15.0.1, which stems from the lack of handling of user-submitted data in the software and can be exploited by an attacker to...

PT-2022-17702 · Unknown · Ametys Cms

Name of the Vulnerable Software and Affected Versions: Ametys CMS versions prior to 4.5.0 Description: The auto-completion plugin in Ametys CMS allows a remote unauthenticated attacker to read documents, which contain all characters typed by all users, including the content of private pages. Thes...

Accounting Journal Management Cross-Site Scripting Vulnerability

Accounting Journal Management is a simple PHP-based accounting journal management system with a trial balance. accounting Journal Management version 1.0 is vulnerable to a cross-site scripting vulnerability that stems from a lack of filtering of user-supplied data and The vulnerability is caused ...

Zenly Social-Media App Bugs Allow Account Takeover

Zenly, a social app from Snap that allows users to see the locations of friends and family on a live map, contains a pair of vulnerabilities that could endanger those being tracked. According to the Checkmarx Security Research Team, the bugs are a user-data exposure vulnerability and an...

Missing server signature validation in OctoberCMS

Impact This advisory affects authors of plugins and themes listed on the October CMS marketplace where an end-user will inadvertently expose authors to potential financial loss by entering their private license key into a compromised server. It has been disclosed that a project fork of October CM...

Security Updates for Microsoft Office Products (February 2022) (macOS)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2022-22003 - A information disclosure...

Cookie Information < 2.0.8 - Reflected Cross-Site Scripting

The plugin does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=wp-gdpr-compliance=%27+onanimationstart%3Dalert%28/XSS/%29+style%3Danimation-name%3Arotation+x...

PT-2022-13362

Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.2.11 Description The issue is related to Cross-site Scripting XSS - Reflected. This means an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take...

Google Bringing Privacy Sandbox to Android to Limit Sharing of User Data

Google on Wednesday announced plans to bring its Privacy Sandbox initiatives to Android in a bid to expand its privacy-focused, but also less disruptive, advertising technology beyond the desktop web. To that end, the internet giant said it will work towards building solutions that prevent...

PT-2022-16739

Name of the Vulnerable Software and Affected Versions PluXml version 5.8.7 Description A stored cross-site scripting XSS issue in the core/admin/medias.php component allows attackers to execute arbitrary web scripts or HTML. This enables them to potentially manipulate the website's content or ste...

Sangoma Technologies Corporation Switchvox information leakage vulnerability

Sangoma Technologies Switchvox is a phone system for businesses of any size from Sangoma Technologies Corporation of Canada. An information disclosure vulnerability exists in Sangoma Technologies Corporation Switchvox that stems from the product not adding a valid access restriction to...

Cross-site Scripting (XSS) - Reflected in cortezaproject/corteza-server

Description The logout function doesn't clean/filter value of "back" parameter before reflecting into html code leading to Reflected XSS vulnerability. Proof of Concept Visit URL: https://latest.cortezaproject.org/auth/logout?back=%22%3E%3Cscript%3Ealertorigin%3C/script%3E%3C%22 Poc:...

Foxit PDF Reader buffer error vulnerability

Foxit PDF Reader is a PDF reader from Foxit China. A security vulnerability exists in Foxit PDF Reader, which stems from a lack of proper validation of user-supplied data, which could result in reading beyond the end of the allocated object, and could be exploited by an attacker to execute...

CVE-2022-22534

Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the...

PT-2022-13240

Name of the Vulnerable Software and Affected Versions chatwoot versions prior to 2.2.0 Description The issue is related to Cross-site Scripting XSS - Stored, which allows attackers to inject malicious scripts into the application. This can lead to unauthorized access to user data. The estimated...

PT-2022-13241

Name of the Vulnerable Software and Affected Versions chatwoot versions prior to 2.2.0 Description The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository chatwoot. This type of attack involves injecting malicious scripts into a website, allowing an attacker...