CVE-2022-22520

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2...

webservice.itinsell.com Cross Site Scripting vulnerability OBB-2814330

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-VRF6-Q7QJ-69V5 Moodle allows attackers to upload files containing JavaScript

webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting XSS attacks, by specifying the...

webservice-hannover.de Improper Access Control vulnerability OBB-2408837

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Glewlwyd Access Control Vulnerability

Glewlwyd is a server for single sign-on servers, OAuth2, OpenidConnect, multi-factor authentication, HOTP/TOTP, FIDO2, TLS certificates, etc., which can be extended by plug-ins An access control vulnerability exists in Glewlwyd that is related to a logical judgment of the affected version. An...

Glewlwyd SSO server 授权问题漏洞

Glewlwyd is a server for single sign-on servers, OAuth2, OpenidConnect, multi-factor authentication, HOTP/TOTP, FIDO2, TLS certificates, etc., which can be extended by plug-ins An access control vulnerability exists in Glewlwyd that is related to a logical judgment of the affected version. An...

CVE-2021-40850

TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx...

CVE-2021-40851

TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information...

Sql injection

TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx...

Information disclosure

TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information...

CVE-2021-40851 TCMAN GIM SQL injection vulnerability

TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information...

CVE-2021-40851

CVE-2021-40851 concerns TCMAN GIM, where a lack of authorization affects all available webservice methods under /PC/WebService.asmx, potentially allowing a remote attacker to obtain information. This is described across NVD/CNVD records, indicating an information disclosure impact with network ac...

CVE-2021-40850

CVE-2021-40850 affects TCMAN GIM. It describes a SQL injection vulnerability in multiple web service methods under /PC/WebService.asmx. The CVSS metrics indicate a critical impact (CVSS v3.1: 9.8, NETWORK, LOW complexity, NONE privileges) with high impact on confidentiality, integrity and availab...

CVE-2021-40851

TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information...

Tcman Gim SQL注入漏洞

Tcman Gim is a facility management software from Tcman Spain designed for use on mobile devices. TCMAN GIM suffers from a SQL injection vulnerability that can be exploited via the "/PC/WebService.asmx" page...

The vulnerability of the AADI GeoView Webservice, a software tool for meteorological observations, lies in the lack of protection for the SQL query structure, allowing attackers to execute arbitrary SQL commands.

The vulnerability of the AADI GeoView Webservice software for meteorological observations lies in the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

CVE-2021-41063

SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands...

CVE-2021-41063

SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands...

Sql injection

SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands...

CVE-2021-41063

The CVE-2021-41063 issue affects the Aanderaa GeoView Webservice (AADI GeoView Webservice) prior to version 2.1.3. The vulnerability is an SQL injection that could allow an unauthenticated attacker to execute arbitrary commands against the GeoView database server. Public sources consistently iden...