Vulnerabilidades

Adobe Experience Manager se ve afectado por una vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) almacenada que un atacante con privilegios bajos podría aprovechar para inyectar scripts maliciosos en campos de formulario vulnerables. Puede ejecutarse JavaScript malicioso en el navegador de la víctima…

Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation…

Adobe Experience Manager se ve afectado por una vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) almacenada que un atacante con privilegios bajos podría aprovechar para inyectar scripts maliciosos en campos de formulario vulnerables. Puede ejecutarse JavaScript malicioso en el navegador de la víctima…

Adobe Experience Manager se ve afectado por una vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) basada en DOM. Un atacante podría explotar este problema manipulando el entorno DOM para ejecutar JavaScript malicioso en el contexto del navegador de la víctima. La explotación de este problema requiere…

Adobe Experience Manager se ve afectado por una vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) basada en DOM. Un atacante podría explotar este problema manipulando el entorno DOM para ejecutar JavaScript malicioso en el contexto del navegador de la víctima. La explotación de este problema requiere…

Adobe Experience Manager se ve afectado por una vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) basada en DOM. Un atacante podría explotar este problema manipulando el entorno DOM para ejecutar JavaScript malicioso en el contexto del navegador de la víctima. La explotación de este problema requiere…

Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could leverage this vulnerability to issue unauthorized server-side requests, potentially gaining elevated access or…

Adobe Experience Manager se ve afectado por una vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) basada en DOM. Un atacante podría explotar este problema manipulando el entorno DOM para ejecutar JavaScript malicioso en el contexto del navegador de la víctima. La explotación de este problema requiere…

Adobe Experience Manager se ve afectado por una vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) basada en DOM. Un atacante podría explotar este problema manipulando el entorno DOM para ejecutar JavaScript malicioso en el contexto del navegador de la víctima. La explotación de este problema requiere…

Adobe Experience Manager se ve afectado por una vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) basada en DOM. Un atacante podría explotar este problema manipulando el entorno DOM para ejecutar JavaScript malicioso en el contexto del navegador de la víctima. La explotación de este problema requiere…

Adobe Experience Manager se ve afectado por una vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) basada en DOM. Un atacante podría explotar este problema manipulando el entorno DOM para ejecutar JavaScript malicioso en el contexto del navegador de la víctima. La explotación de este problema requiere…

Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Window PC Manager allows an authorized attacker to elevate privileges locally.

A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if…

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This…

Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0…

An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user…

A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLeave/admin/accept.php of the component POST Handler. Performing a manipulation of the argument appid results in sql injection. The attack is possible to be carried out remotely.…

A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /SimpleOnlineLeave/admin/deletemp.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has…

Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.

Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.17.