451 matches found
GitLab 12.4 < 13.2.10 / 13.3 < 13.3.7 / 13.4 < 13.4.2 (CVE-2020-13340)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log CVE-2020-13340 Note that Nessus has not tested for this issue but has instea...
Duplicate Advisory: AVideo cross-site scripting vulnerability in the view/about.php page
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f98p-2hc5-fm7v. This link is maintained to preserve external references. Original Description WWBN AVideo 12.4 is vulnerable to Cross Site Scripting XSS...
CVE-2024-34899
WWBN AVideo 12.4 is vulnerable to Cross Site Scripting XSS...
CVE-2024-34899
WWBN AVideo 12.4 is vulnerable to Cross Site Scripting XSS...
CVE-2024-34899
CVE-2024-34899 corresponds to a Cross-Site Scripting (XSS) vulnerability in WWBN AVideo 12.4. Connected sources confirm the issue stems from insufficient input sanitization, with explicit mentions of XSS in the view/about.php page (user-agent header echoed without sanitization) and broader XSS de...
PT-2024-26240 · Wwbn · Avideo
Name of the Vulnerable Software and Affected Versions: WWBN AVideo version 12.4 Description: The issue is related to Cross Site Scripting XSS due to the lack of sanitization of the HTTP USER AGENT variable. In the view/about.php file, the website retrieves the user agent from the headers through ...
PT-2024-5038 · Wwbn · Wwbn Avideo
Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 12.4 through 14.2 Description: The issue in WWBN AVideo is related to insufficient input validation in the submitIndex.php file of the WWBNIndex plugin, allowing a remote attacker to execute arbitrary code via the...
CVE-2024-24751
sfeventmgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the RedirectResponse from the...
CVE-2024-24751 Broken Access Control in Backend Module in sf_event_mgt
sfeventmgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the RedirectResponse from the...
sf_event_mgt Security Vulnerability
sfeventmgt is a TYPO3 CMS event management and registration extension based on ExtBase and Fluid. A security vulnerability exists in version 7.0.0 of sfeventmgt, which stems from a security flaw during the update of the extension to TYPO3 12.4...
PT-2023-7977 · Freebsd · Freebsd
Name of the Vulnerable Software and Affected Versions: FreeBSD versions 12.4-RELEASE through 12.4-RELEASE-p8 FreeBSD versions 13.2-RELEASE through 13.2-RELEASE-p6 FreeBSD versions 14.0-RELEASE through 14.0-RELEASE-p1 Description: The pf4 packet filter in FreeBSD incorrectly validates TCP sequence...
Oracle Financial Services Applications Security Vulnerability
Oracle Financial Services Applications and Oracle FLEXCUBE Universal Banking are both products of Oracle Corporation, USA.Oracle Financial Services Applications is a suite of financial services Oracle Financial Services Applications is a suite of financial services software. Oracle Financial...
Oracle Financial Services Applications Security Vulnerability
Oracle Financial Services Applications and Oracle FLEXCUBE Universal Banking are both products of Oracle Corporation, USA.Oracle Financial Services Applications is a suite of financial services Oracle Financial Services Applications is a suite of financial services software. Oracle Financial...
FreeBSD-SA-23:12.msdosfs
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-23:12.msdosfs Security Advisory The FreeBSD Project Topic: msdosfs data disclosure Category: core Module: msdosfs FAT file system driver Announced: 2023-10-03...
Cross site scripting
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded...
CVE-2023-32073 AVideo command injection vulnerability
WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at plugin/CloneSite/cloneClient.json.php which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to...
CVE-2023-30860 WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account
WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert...
CVE-2023-30854
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint /plugin/CloneSite/cloneClient.json.php allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4...
Command injection
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint /plugin/CloneSite/cloneClient.json.php allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4...
CVE-2023-30854
WWBN AVideo (open-source video platform) has a documented OS command-injection vulnerability in the authenticated endpoint /plugin/CloneSite/cloneClient.json.php. Attackers can achieve Remote Code Execution via this endpoint, with the issue fixed in version 12.4 per CVE-2023-30854. Red Hat adviso...