15151 matches found
CVE-2022-4259 Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2
Due to improper input validation in the Alerts controller, a SQL injection vulnerability in Nozomi Networks Guardian and CMC allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application...
CVE-2022-4259
The CVE-2022-4259 vulnerability affects Nozomi Networks Guardian and CMC, caused by improper input validation in the Alerts controller that enables authenticated SQL injection. A logged-in attacker can execute arbitrary SQL queries on the web application's DBMS, with impact on confidentiality, in...
Sql injection
ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection Time-based via the ENtyid POST parameter...
Nozomi Networks Guardian SQL注入漏洞
Nozomi Networks Guardian is an IoT device and software inspection system from US-based Nozomi Networks. A security vulnerability exists in Nozomi Networks Guardian and CMC that stems from improper input validation in the Alerts Controller. An attacker could exploit the vulnerability to execute...
phpmyFAQ < 3.2.0-beta.2 XSS Vulnerability
phpMyFAQ is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"...
Moodle 4.1.x < 4.1.3 Arbitrary Folder Creation Vulnerability (MSA-23-0014)
Moodle is prone to an arbitrary folder creation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle";...
AIX is vulnerable to HTTP request smuggling due to Perl
IBM SECURITY ADVISORY First Issued: Wed May 3 09:23:25 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/perladvisory6.asc Security Bulletin: AIX is vulnerable to HTTP request smuggling due to Perl CVE-2022-31081...
PHPJabbers Simple CMS 5.0 Cross Site Scripting
Exploit Title: PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting XSS Date: 2023-04-29 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.phpjabbers.com/faq.php Software Link: https://www.phpjabbers.com/simple-cms/ Version: 5.0 Tested on: Kali Linux Steps to Reproduce - Please...
Judging Management System SQL注入漏洞
Judging Management System is a judging management system by Carlo Montero Personal Developer. A security vulnerability exists in Judging Management System v1.0, which originates from a SQL injection vulnerability in the judgeid parameter in /php-jms/editjudge.php...
Design/Logic Flaw
Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...
CVE-2023-30861
Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...
CVE-2023-30861
Flask vulnerability CVE-2023-30861 arises when a responsive cached by a proxy may include data for one client and serve it to others, potentially leaking a session cookie. Root cause: Flask previously only set the Vary: Cookie header when the session was accessed or modified, not when it was refr...
Stored XSS at User-Agent of Headers
Description Stored XSS attack, also known as persistent XSS attack, refers to a type of web application vulnerability where the attacker injects malicious code or script into the web application, typically into a database or other storage mechanism, and later the code/script is delivered to an...
Aigital Wireless-N Repeater Mini_Router 代码问题漏洞
The Aigital Wireless-N Repeater Mini-Router is a wireless router repeater from Aigital. A security vulnerability exists in the Aigital Wireless-N Repeater Mini-Router.v0.131229 version, which stems from a problem in the time-based authentication mechanism that allows an attacker to bypass login b...
revive-adserver v5.4.1 - Cross-Site Scripting (XSS)
Exploit Title: revive-adserver v5.4.1 - Cross-Site Scripting XSS Application: revive-adserver Version: 5.4.1 Bugs: XSS Technology: PHP Vendor URL: https://www.revive-adserver.com/ Software Link: https://www.revive-adserver.com/download/ Date of found: 31-03-2023 Author: Mirabbas Ağalarov Tested o...
CVE-2023-30403
An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater MiniRouter v0.131229 allows attackers to bypass login by connecting to the web app after a successful attempt by a legitimate user...
GHSA-PJFJ-QVQW-3F6V Apache StreamPark LDAP Injection vulnerability
Apache StreamPark versions 1.0.0 to 2.0.0 have an LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements...
Sql injection
Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through...
Aigital Wireless-N Repeater Mini_Router.0.131229 Authentication Bypass
Exploit Title: Aigital Wireless-N Repeater - Login Bypass Exploit Author: Matteo Mandolini Date : 13/04/2023 Vendor Homepage: https://web.archive.org/web/20220625053314/https://www.aigital.com/ Version: MiniRouter.0.131229 Login bypass The device web application relies on a time-based mechanism t...