UI REDRESSING

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Proof of Concept Go to this URL:...

CVE-2022-34305

A flaw was found in the Apache Tomcat package. An example web application did not filter the form authentication example, exposing a Cross-site scripting XSS vulnerability...

The vulnerability in the LDAP Account Manager web application exists due to the lack of measures taken to neutralize special elements, allowing attackers to use the user’s username field to manipulate LDAP data.

The vulnerability in the LDAP Account Manager web application exists due to the failure to take measures to neutralize certain special elements. Exploiting this vulnerability allows a malicious actor to use the user’s username field to manipulate LDAP data...

Online Railway Reservation System SQL注入漏洞

Sourcecodester Online Railway Reservation system is a web-based application that provides an online platform for rail or train station passengers or potential passengers to browse their schedules and reserve seats. sourceCodester Online Railway Reservation System v1.0 is vulnerable to a SQL...

Piwigo <= 11.5.0 RCE Vulnerability

Piwigo is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo"; if...

Stored Cross-Site Scripting vulnerability in Recipe Instructions allows Admin session hijacking

Description A low privilege user can insert malicious JavaScript code into the Recipe Instructions which will execute in another person's browser that visits the recipe. Proof of Concept Reproduction Steps: 1. As a lower privileged user login to the Mealie web application. 2. Create a recipe and...

Wyse Management Suite Cross-Site Scripting Vulnerability (CNVD-2022-62182)

Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell, USA. The product includes centralized management of Wyse endpoints, asset tracking and automated device discovery. A cross-site scripting vulnerability exists in Wyse Management Suite 3.6.1 and prio...

FlatPress <= 1.2.1 XSS Vulnerability (Sep 2021)

FlatPress is prone to a cross-site scripting XSS vulnerability in the blog content. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2022-23173

this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs to access the "Login menu - demo site" then he can see in this menu all the functionality of the application. If the attacker will try to click on one of the links, he will get a...

PT-2022-4815 · Nginx +8 · Nginx +8

Name of the Vulnerable Software and Affected Versions: HTTP::Daemon versions prior to 6.15 Description: The issue is related to inconsistent interpretation of HTTP requests when handling Content-Length values, potentially allowing a remote attacker to gain privileged access to APIs or poison...

Apache Tomcat 8.5.50 < 8.5.82 Cross-Site Scripting

The version of Apache Tomcat installed on the remote host is 8.5.50 to 8.5.81, 9.0.30 to 9.0.64, 10.0.0-M1 to 10.0.22 or 10.1.0-M1 to 10.1.0-M16. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability. The Form authentication example in the examples web application displayed user...

UI REDRESSING

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Proof of Concept 1 Go to this URL:...

CVE-2022-1666

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

CVE-2022-1666

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

Default credentials

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

CVE-2022-1666 Secheron SEPCOS Control and Protection Relay

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

CVE-2022-1666 Secheron SEPCOS Control and Protection Relay

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

CVE-2022-1666

CVE-2022-1666 affects Secheron SEPCOS Control and Protection Relay. The root cause is insufficiently protected credentials: the web app’s root account uses a weak default password, with MD5-based cracking noted. This can allow an attacker with network access to obtain OS/root-level privileges on ...

CVE-2022-32403

Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/managerecord.php:4...

GHSA-6J88-6WHG-X687 Cross-site Scripting in Apache Tomcat

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...