The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce validation in the ~/includes/settings.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A malicious maintainer could exfiltrate a GitHub integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.
Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands� service, which allows any user on the same network segment as the controller (even while connected remotely) to access the service and write unauthorized macros to the device.
Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into registers outside of the authorized accessible range. This could allow a user to access privileged resources or resources out of context.
SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.
SEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php.
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php.
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Zekou.php.
SEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php.