377 matches found
CVE-2022-23861
Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...
CVE-2022-23862
A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...
CVE-2022-23861
CVE-2022-23861 affects YSoft SAFEQ 6 Build 53. The vulnerability is Multiple Stored Cross-Site Scripting (XSS) in the SafeQ web interface, caused by lack of output sanitization in multiple input fields, allowing arbitrary JavaScript execution for users accessing the web UI. Connected sources corr...
CVE-2022-23861
Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...
CVE-2022-23862
A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...
CVE-2022-23862
CVE-2022-23862 affects Y Soft SAFEQ 6 Build 53. The SafeQ JMX service on port 9696 is vulnerable to JMX MLet attacks because authentication was not enforced and the service ran under NT AUTHORITY\System, enabling an attacker to execute arbitrary code and escalate to SYSTEM locally. Public PoC and...
PT-2024-11525 · Ysoft · Y Soft Safeq
Name of the Vulnerable Software and Affected Versions: Y Soft SAFEQ version 6 Build 53 Description: Multiple Stored Cross-Site Scripting issues were discovered in the YSoft SafeQ web application. The lack of output sanitization in multiple fields allows for the injection of malicious inputs,...
CVE-2024-43940
Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N I T H: from n/a through 7.4.9...
CVE-2024-43939
Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N I T H: from n/a through 7.4.9...
CVE-2024-43940 WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Plugin Settings Change vulnerability
Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N I T H: from n/a through 7.4.9...
CVE-2024-43940 WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Plugin Settings Change vulnerability
Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N I T H: from n/a through 7.4.9...
CVE-2024-43940
CVE-2024-43940 is a Missing Authorization vulnerability in Zynith SEO (Zynith) for WordPress, affecting 7.4.9 and earlier. It allows Accessing Functionality Not Properly Constrained by ACLs. The connected sources corroborate the issue and indicate it remains unpatched; no public remediation or ex...
CVE-2024-43939 WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Arbitrary Option Deletion vulnerability
Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N I T H: from n/a through 7.4.9...
CVE-2024-43939
CVE-2024-43939 (Zynith SEO) is a Missing Authorization vulnerability in Zynith SEO for WordPress (affecting versions up to and including 7.4.9) that allows unauthenticated users to delete arbitrary options due to improper access control. The Wordfence vulnerability report explicitly states an Una...
CVE-2024-43939 WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Arbitrary Option Deletion vulnerability
Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N I T H: from n/a through 7.4.9...
WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Plugin Settings Change vulnerability
Unauthenticated Plugin Settings Change vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Z Y N I T H versions = 7.4.9...
WordPress Z Y N I T H Plugin <= 7.4.9 is vulnerable to Settings Change
Software Z Y N I T H Type Plugin Vulnerable versions = 7.4.9 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-43939 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7f62f3b06158 Credits Dave Jong Patchstack Required...
WordPress Z Y N I T H Plugin <= 7.4.9 is vulnerable to Settings Change
Software Z Y N I T H Type Plugin Vulnerable versions = 7.4.9 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-43940 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b82e28b179e8 Credits Dave Jong Patchstack Required...
PT-2024-37680 · Unknown · Y Project Ruoyi
Name of the Vulnerable Software and Affected Versions: y project RuoYi versions up to 4.7.9 Description: A vulnerability was found in the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT TYPE leads to cross site scripting. The atta...
