1697 matches found
DEBIAN-CVE-2020-35477
MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox or a tags checkbox next to it, there i...
Zeroshell 操作系统命令注入漏洞
Zeroshell is a small open source Linux distribution for servers and embedded systems designed to provide web services. a command injection vulnerability exists in the /cgi-bin/kerbynet StartSessionSubmit parameter in Zeroshell 3.9.3. An attacker could execute system commands via shell...
Amazon AWS Encryption SDK Encryption Issues Vulnerabilities
The Amazon AWS Encryption SDK is a development toolkit for encryption applications from Amazon.com, USA. A security vulnerability exists in the AWS Encryption SDK that stems from the SDK's use of the non-submit attribute of AES-GCM as well as other AEAD ciphers such as AES-GCM-SIV or...
Unbreakable Enterprise kernel-container security update
4.14.35-2025.402.2.1.el7 - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 4.14.35-2025.402.2.el7 - ocfs2: fix remounting needed after setfacl command Gang He - Fix multiple variable definition with syzkaller Hans Westgaard Ry Orabug:...
SonarSource SonarQube Authentication Bypass Vulnerability
SonarSource SonarQube is an open source code quality management system from SonarSource Switzerland. An authentication bypass vulnerability exists in SonarQube version 8.4.2.36762, which allows an external attacker to implement authentication bypass via SonarScanner to create and overwrite public...
CVE-2020-4632: Server-Side Request Forgery (SSRF)
IBM InfoSphere Metadata Asset Manager 11.7 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to submit or control server requests. IBM X-Force ID: 185416...
GHSA-WHRH-9J4Q-G7PH CSRF Vulnerability in polaris-website
Impact CSRF vulnerability: In some very specific circumstances, an attacker would be able to update your settings. Basically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't check if it worked, nor could they read your...
CSRF Vulnerability in polaris-website
Impact CSRF vulnerability: In some very specific circumstances, an attacker would be able to update your settings. Basically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't check if it worked, nor could they read your...
Cross-site Request Forgery (CSRF)
save-server is vulnerable to cross-site request forgery CSRF. The vulnerability exists due to the lack of authenticity token used in the requests, allowing an attacker to trick users into visiting a malicious site and submit requests on behalf of the user...
CVE-2020-15135
save-server npm package before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation Tokens etc.. The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
CVE-2020-15135
save-server npm package before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation Tokens etc.. The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
Cross site request forgery (csrf)
save-server npm package before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation Tokens etc.. The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
CVE-2020-15135
The CVE-2020-15135 entry concerns the save-server npm package, where versions before 1.05 are vulnerable to CSRF due to no CSRF mitigation. The issue enables a attacker, via a malicious site, to perform actions like uploading/deleting files, adding redirects, and potentially managing users if the...
CVE-2020-15135: Cross-Site Request Forgery (CSRF)
save-server npm package before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation Tokens etc.. The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
DRUPAL-CONTRIB-2020-029
The Modal form module is a toolset for quick start of using forms in modal windows. Any form is available for view and submit when the modalform module is installed. The only requirement is to know the form's fully-qualified class name...
CVE-2018-19798: Unrestricted Upload of File with Dangerous Type
Fleetco Fleet Maintenance Management FMM 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidentsadd.php?submit=1 URI, as demonstrated by the valueImages1 field, which leads to remote command execution on the remote server. Any authenticat...
Rockstar Games: csrf in https://www.rockstargames.com/reddeadonline/feedback/submit.json
In this report, the researcher discovered an endpoint that lacked CSRF protection and demonstrated a way to exploit it via a remote webserver. Typically CSRF-related reports are not eligible for bounty, but the impact of this exploit was high enough to warrant a reward. This was only exploitable ...
Linux: Permissions on /etc/at.allow
The at.allow file controls who can submit jobs via at or batch. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free...