CVE-2022-3255 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify...

Rapid7 InsightVM 代码问题漏洞

Rapid7 InsightVM is a vulnerability scanning and management application from Rapid7 USA. A security vulnerability exists in Rapid7 InsightVM that stems from the presence of an information disclosure issue that allows an attacker to use the Inspect Element browser feature to delete the login panel...

CVE-2022-2753

The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made...

CVE-2022-2753 Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Stored XSS

The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made...

PT-2022-26582 · Apple · Macos Monterey +5

Name of the Vulnerable Software and Affected Versions: macOS Big Sur versions prior to 11.7 macOS Monterey versions prior to 12.6 macOS Ventura version 13 is not affected, versions prior to 13 are not specified iOS versions prior to 15.7 and 16 iPadOS versions prior to 15.7 Description: A logic...

Apple macOS Big Sur 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS Big Sur versions prior to 11.7, which stems from the fact that users may be able to view sensitive user information...

PT-2022-17101 · WordPress · Simple Banner

Name of the Vulnerable Software and Affected Versions: Simple Banner plugin for WordPress versions up to and including 2.11.0 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers to inject arbitrary web scripts via the pro versio...

Visual Composer Website Builder < 45.0.1 - Authenticated Stored XSS via Text Block

The plugin does not sanitise and escape its Text Block fields, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks PoC Create a post using the plugin editor, add a Text Block and put the following payload in its content: The XSS will be triggered whe...

Design/Logic Flaw

Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application...

CVE-2022-22326

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...

Authorization

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...

CVE-2022-22326

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...

CVE-2022-22326

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...

Apple iOS 和 iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for the iPad tablet. Apple iOS and iPadOS contain a security vulnerability that can be exploited by an attacker with physical access to the...

Chcnav P5E GNSS 信任管理问题漏洞

Chcnav P5E GNSS is a Global Positioning System from Chcnav. The Chcnav P5E GNSS suffers from a trust management issue vulnerability that originates from allowing to view usernames and passwords without privileges, which could be exploited by an attacker to potentially gain access to the system...

Siemens JT2Go and Teamcenter Visualization越界读取漏洞

JT2Go is a 3D JT viewing tool that allows users to view JT, PDF, Solid Edge, PLM XML, and available JT, VFZ, CGM, and TIF data. teamcenter Visualization enables companies to enhance their product lifecycle management PLM environments with a comprehensive family of visualization solutions. The...

Siemens JT2Go and Teamcenter Visualization Out-of-Bounds Read Vulnerability (CNVD-2022-51433)

JT2Go is a 3D JT viewing tool that allows users to view JT, PDF, Solid Edge, PLM XML, and available JT, VFZ, CGM, and TIF data. teamcenter Visualization enables companies to enhance their product lifecycle management PLM environments with a comprehensive family of visualization solutions. The...

CVE-2021-38289

An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts. NOTE: As of April 2026, the vendor has officially...

SAP NetWeaver和SAP NetWeaver Enterprise Portal 跨站脚本漏洞

SAP NetWeaver Enterprise Portal is a web front-end component of SAP NetWeaver. A cross-site scripting vulnerability exists in SAP NetWeaver Enterprise Portal, which can be exploited by attackers to view or modify information...

CVE-2022-29512

Exposure of sensitive information to an unauthorized actor issue in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the data without the viewing privilege...