An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1.3 and below (WatsonWebserver) due to insufficient validation of input IP addresses and netmasks against the...
xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges. Date published : 2022-05-16 https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code. Date published : 2022-05-16 https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code. Date published : 2022-05-16 https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03
The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system. Date published : 2022-05-16 https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate...
The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code. Date published : 2022-05-16 https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01
The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file...
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods. Date published : 2022-05-16 https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051603
An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator. Date published : 2022-05-16 https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602
A logged-in and authenticated user with a Reviewer Role may lock a content item. Date published : 2022-05-16 https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051601
Openmoney API through 2020-06-29 uses the JavaScript Math.random function, which does not provide cryptographically secure random numbers. Date published : 2022-05-16 https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/random https://github.com/openmoney/openmoney-api/blob/1b836e5826dfd59145223a8a48e6c45ddb325762/api/helpers/util.helper.js#L6
Parallels H-Sphere 3.6.2 allows XSS via the index_en.php from parameter. Date published : 2022-05-16 https://en.wikipedia.org/wiki/H-Sphere https://medium.com/@bhattronit96/cve-2022-30777-45725763ab59
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter. Date published : 2022-05-16 https://help.atmail.com/hc/en-us/sections/115003283988 https://medium.com/@bhattronit96/cve-2022-30776-cd34f977c2b9