CVE-2023-42458

Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the...

CVE-2023-42458

CVE-2023-42458 affects the Zope web application server. A stored cross-site scripting (XSS) vulnerability exists for SVG images in versions prior to 4.8.10 and 5.8.5. An attacker would need to upload an image and lure a user to click a crafted link to trigger the vulnerability; however, an image ...

Design/Logic Flaw

web\ViewAction in Yii aka Yii2 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter...

Luxcal Event Calendar 3.2.3 Cross Site Request Forgery

==================================================================================================================================== | Title : Luxcal Event Calendar v3.2.3 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3 32-bit...

The vulnerability of the MODULYS GP (MOD3GP-SY-120K) module-based power supply management web application allows a attacker to execute arbitrary code.

The vulnerability of the MODULYS GP MOD3GP-SY-120K module-based power supply management web application is related to incorrect code generation. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability in the MODULYS GP (MOD3GP-SY-120K) module-based failover management web application allows attackers to execute attacks using cross-site scripting (XSS).

The vulnerability of the MODULYS GP MOD3GP-SY-120K web-based management application exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out attacks using cross-site scripting XSS...

Do You Really Trust Your Web Application Supply Chain?

Well, you shouldn't. It may already be hiding vulnerabilities. It's the modular nature of modern web applications that has made them so effective. They can call on dozens of third-party web components, JS frameworks, and open-source tools to deliver all the different functionalities that keep the...

CVE-2022-47561

The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious...

CVE-2022-47561

The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious...

Design/Logic Flaw

UNSUPPPORTED WHEN ASSIGNED The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to...

CVE-2022-47561

CVE-2022-47561 concerns Ormazabal products where credentials are stored in clear text in admin.xml and can be accessed without logging in, exposing all user credentials (including admin). Public documents confirm the vulnerability and its impact on confidentiality, with exposure of credentials en...

PHP-Login-System Cross-Site Scripting Vulnerability

PHP-Login-System is a web application. A security vulnerability exists in PHP-Login-System version 2.0.1, which stems from a vulnerability that allows a remote attacker to execute arbitrary JavaScript - passwords in a user's web browser by including a malicious load in the validator parameter in...

Elevate Your Cybersecurity with Imperva Cloud WAF: More Than Just a Checkbox

In the world of digital modernization, having a web application firewall WAF isnt an option - its a necessity. But in the endless sea of security solutions, how do you choose the right one? How do you ensure that youre not merely checking a box, but genuinely fortifying your digital fortress? Whi...

CVE-2023-2567

A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality. Authenticated users may be able to execute arbitrary SQL statements on the DBMS used by the web application...

Sql injection

A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality, allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application. Authenticated users can extract...

CVE-2023-29245 SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0

A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our IDS, may allow an unauthenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application by sendi...

CVE-2023-2567 Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0

A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality. Authenticated users may be able to execute arbitrary SQL statements on the DBMS used by the web application...

PT-2023-22220 · Nozomi Networks · Nozomi Networks Cmc +1

Name of the Vulnerable Software and Affected Versions: Nozomi Networks Guardian and CMC affected versions not specified Description: A SQL Injection issue, due to improper input validation in certain fields used in the Asset Intelligence functionality of the IDS, may allow an unauthenticated...

CVE-2023-39452

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application...

CVE-2023-39452

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application...