CVE-2022-38359

CVE-2022-38359 concerns the Eyes of Network web application, where a lack of anti-CSRF protections enables cross-site request forgery. The issue allows an authenticated attacker to trigger administrative actions by steering a user to a crafted link such as …/module/admin_user/index.php?DataTables...

CVE-2022-38359

Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections. An attacker can, for instance, delete the admin user by directing an authenticated user to the URL...

CVE-2022-38358

Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting attacks at /module/adminnotifiers/rules.php and /module/reportevent/indext.php via the parameters rulenotification, rulename, and rulenameold, and at...

CVE-2022-38358

Eyes of Network Web 5.3 is affected by a cross-site scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects multiple endpoints, including /module/admin_notifiers/rules.php (parameters rule_notification, rule_name, rule_name_old), /mod...

Cross site scripting

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser...

PT-2022-24385 · Unknown · Eyes Of Network Web Application

Name of the Vulnerable Software and Affected Versions: Eyes of Network Web application affected versions not specified Description: The issue is related to the improper neutralization of special elements, making the Eyes of Network Web application susceptible to an iFrame injection attack. This...

PT-2022-24386 · Unknown · Eyesofnetwork

Name of the Vulnerable Software and Affected Versions: Eyes of Network affected versions not specified Description: The issue is related to improper neutralization of input during web page generation, making the Eyes of Network web application susceptible to cross-site scripting attacks. This can...

Fixed in Apache Tomcat 8.5.82

Low: Apache Tomcat XSS in examples web application CVE-2022-34305 The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. This was fixed with commit 5f6c88b0. This issue was reported to the Apache Tomcat Securit...

Student Information System SQL注入漏洞

Student Information System is a web-based application platform by Carlo Montero, a personal developer. It can help a university or college to manage student information and academic records. A SQL injection vulnerability exists in Student Information System. An attacker can exploit this...

Readymade Job Portal Script SQL Injection

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

ARRIS Routers Information Disclosure Vulnerability (Jun 2022) - Active Check

Multiple ARRIS routers are prone to an information disclosure vulnerability in the underlying muhttpd web server. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2022-2634

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

CVE-2022-2634

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

Design/Logic Flaw

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

Path traversal

WMS 3.7 contains a Path Traversal Vulnerability in Device API. An attacker could potentially exploit this vulnerability, to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application...

CVE-2022-34365

WMS 3.7 contains a Path Traversal Vulnerability in Device API. An attacker could potentially exploit this vulnerability, to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application...

Dell Wyse Management Suite 跨站脚本漏洞

Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell, Inc. The product includes centralized Wyse endpoint management, asset tracking and automated device discovery. context of a vulnerable Web application and execute malicious HTML or JavaScript code i...

CVE-2022-2634 Digi ConnectPort X2D

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...

CVE-2022-2634

The CVE-2022-2634 entry maps to Digi ConnectPort X2D Gateway vulnerabilities where the web application lacks device access protections and permissions, allowing an attacker to upload Python files that can be executed. Concrete details from connected sources indicate affected products are Digi Con...

CVE-2022-2634 Digi ConnectPort X2D

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed...