107,314 results · Clear filters · Feed
-
Medium 5.1
IBM Aspera Enterprise Webapps Information Disclosure
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information.
-
Medium 5.3
code-projects Online Ticket Reservation System medallion.sql file information disclosure
A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql. The manipulation results in file and directory information exposure. It is possible to launch the …
-
Medium 6.4
IBM Planning Analytics Local is affected by security vulnerabilities
IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disc…
-
Medium 5.4
IBM Planning Analytics Local is affected by security vulnerabilities
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.
-
Medium 6.5
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate datab…
-
Medium 4.3
Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JM…
-
Medium 6.5
Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their…
-
Medium 5.4
Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name tha…
-
Medium 4.3
Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accoun…
-
Medium 4.3
Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints …
-
Medium 6.5
Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify i…
-
Medium 4.3
Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records,…
-
Medium 4.3
Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification
Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role…
-
Medium 6.5
Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters
Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database q…
-
Medium 6.1
Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated at…
-
Medium 6.5
Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can quer…
-
Medium 6.5
Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify prod…
-
Medium 6.5
Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their as…
-
Medium 5.4
Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name
Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the br…
-
Medium 6.5
Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, b…
-
Medium 6.5
Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call the…
-
Medium 6.5
Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to …
-
Medium 5.4
Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call t…
-
Medium 4.3
Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authe…
-
Medium 6.5
Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read person…
-
Medium 6.5
Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the aff…
-
Medium 6.5
Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensi…
-
Medium 6.5
Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database quer…
-
Medium 6.5
Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and e…
-
Medium 6.5
Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify…
-
Medium 6.5
Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read…
-
Medium 4.3
Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned…
-
Medium 6.5
Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read pro…
-
Medium 6.5
Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate ava…
-
Medium 6.5
Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted …
-
Medium 6.5
Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries a…
-
Medium 6.5
Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauth…
-
Medium 6.5
Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read fin…
-
Medium 4.9
Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL…
-
Medium 4.3
Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints
Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send r…