Barco Control Room 授权问题漏洞

Barco Control Room is a visualization and collaboration solution from Barco Belgium. It is used to build control rooms. A security vulnerability previously existed in the Barco Control Room Management Suite web application version 3.14, which stemmed from the ability to expose log files without...

Gogs < 0.12.8 SSRF Vulnerability

Gogs is prone to a server-side request forgery SSRF vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2022-26978

Barco Control Room Management Suite (TransForm N) before version 3.14 is affected. The vulnerability is a reflected XSS in the /checklogin.jsp endpoint where the os_username parameter is not properly sanitized, allowing client-side script execution. Exploitation context is network-based via that ...

CVE-2022-26978

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint. The osusername parameters is not correctly sanitized, leading to reflected XSS...

CVE-2022-26977

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization of the upload mechanism is leads to stored XSS...

CVE-2022-26977

The Barco Control Room Management Suite web application (TransForm N before 3.14) exposes a license file upload mechanism with insufficient input sanitization, resulting in stored XSS. Affected component is the upload handling; impact is client-side script execution. No exploitation details are p...

CVE-2022-26975

CVE-2022-26975 affects the Barco Control Room Management Suite web application (part of TransForm N) prior to version 3.14. The issue is exposure of log files without authentication, as documented by Red Hat/NVD entries and vendor references. CVSSv3.1 base score 7.5 (HIGH) with HIGH confidentiali...

CVE-2022-26973

The Barco Control Room Management Suite web application (TransForm N) prior to version 3.14 exposes a license file upload mechanism. The root cause is a flaw in handling the license file name, where manipulating the filename causes the application to return an error message that reveals internal ...

CVE-2022-26972

Barco Control Room Management Suite (TransForm N) web application is affected up to version 3.14. The vulnerability stems from unsanitized URL parameters on the /cgi-bin endpoint, enabling reflected cross-site scripting (XSS). Multiple connected sources corroborate the issue and scope, without de...

CVE-2022-26971

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. This upload can be executed without authentication...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to Spoofing (CVE-2022-22365)

Summary IBM WebSphere Application Server is vulnerable to spoofing when the Ajax Proxy Web Application AjaxProxy.war is deployed. This has been addressed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products...

PT-2022-18149 · Barco · Transform N +1

Name of the Vulnerable Software and Affected Versions: Barco Control Room Management Suite web application, which is part of TransForm N versions prior to 3.14 Description: The issue concerns the exposure of a license file upload mechanism in the web application without requiring authentication...

SPIP < 3.1.14 Multiple Vulnerabilities

SPIP is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...

manorpreschool.org Cross Site Scripting vulnerability OBB-2634235

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Yelp: installed.json sensitive file was publicly accessible on your web application which discloses information about authors and admins

kindly if you don't accept this issue please close it as informative , thanks in advance Description: The installed.json file is a sensitive file and it was publicly accessible on your webserver , which discloses some information about your web site and users such as authors like admin as shown...

QNAP QuTS hero XSS Vulnerability (QSA-21-63)

QNAP QuTS hero is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Opencast < 9.10 HTTP Method Spoofing Vulnerability

Opencast is prone to an HTTP method spoofing vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Lumidek Associates Simple Food Website Cross-Site Request Forgery Vulnerability

Lumidek Associates Simple Food Website is a Simple Food Website CMS. version 1.0 of Lumidek Associates Simple Food Website is vulnerable to cross-site request forgery, which stems from a WEB application that does not adequately validate that the request is from a trusted user. An attacker could...

GHSA-CJ7G-H7RF-H8J9 Apache Superset OS Command Injection

While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s os package in the web application process in versions 0.37.1. It was thus...

Elevation of privilege in ASP.NET Core

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'...