UI REDRESSING

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Proof of Concept 1 Go to this URL:...

CVE-2022-1666

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

CVE-2022-1666

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

Default credentials

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

CVE-2022-1666 Secheron SEPCOS Control and Protection Relay

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

CVE-2022-1666 Secheron SEPCOS Control and Protection Relay

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

CVE-2022-1666

CVE-2022-1666 affects Secheron SEPCOS Control and Protection Relay. The root cause is insufficiently protected credentials: the web app’s root account uses a weak default password, with MD5-based cracking noted. This can allow an attacker with network access to obtain OS/root-level privileges on ...

CVE-2022-32403

Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/managerecord.php:4...

GHSA-6J88-6WHG-X687 Cross-site Scripting in Apache Tomcat

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

Vulnerability in examples of authenticity verification using forms in examples of web application server applications like Apache Tomcat, which allows attackers to carry out cross-site scripting attacks.

The vulnerability in examples of authenticity verification using forms in web application examples involving Apache Tomcat servers exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remote...

Jenkins 2.335 < 2.356 Information Disclosure Vulnerability (SECURITY-2777) - Windows

Jenkins is prone to an information disclosure vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Mahara 20.04.x < 21.04.6, 21.10.x < 21.10.4, 22.04.x < 22.04.2 Information Disclosure Vulnerability

Mahara is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mahara:mahara"; if...

CVE-2022-32987

CVE-2022-32987 concerns multiple cross-site scripting (XSS) vulnerabilities in Simple Bakery Shop Management System v1.0, specifically in the /bsms/?page=manage_account page. The issue arises from crafted input in the Username or Full Name fields, enabling execution of arbitrary web scripts/HTML....

DEBIAN-CVE-2022-34305

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

CVE-2022-34305

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

Cross site scripting

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

CVE-2022-34305

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

CVE-2022-34305

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

CVE-2022-34305 XSS in examples web application

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

Apache Tomcat 9.0.30 < 9.0.65

The version of Tomcat installed on the remote host is prior to 9.0.65. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.65security-9 advisory. - In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form...