CVE-2020-18123

A cross-site request forgery CSRF vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts...

CVE-2020-18126

Multiple stored cross-site scripting XSS vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML...

CVE-2020-18127

CVE-2020-18127 affects Indexhibit 2.1.5, specifically the /config/config.php component. The vulnerability is an improper access control that lets an attacker view arbitrary files. Documented impact is file disclosure; no exploit details are provided in the sources. Related notices (e.g., PT-2021-...

CVE-2020-18127

An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files...

Indexhibit 跨站请求伪造漏洞

Indexhibit is a web-based content management system. A cross-site request forgery vulnerability exists in Indexhibit version 2.1.5. An attacker can exploit this vulnerability to arbitrarily delete an administrator account...

Indexhibit 跨站脚本漏洞

Indexhibit is a web-based content management system. A reflection-based cross-site scripting vulnerability exists in the /plugin/ajax.php component of Indexhibit version 2.1.5. An attacker could use this vulnerability to execute arbitrary web script or HTML...

Indexhibit 跨站请求伪造漏洞

Indexhibit is a web-based content management system. indexhibit version 2.1.5 is vulnerable to cross-site request forgery. An attacker can use this vulnerability to arbitrarily reset the account password...

Indexhibit 路径遍历漏洞

Indexhibit is a web-based content management system. An improper access control vulnerability exists in the /config/config.php component of Indexhibit version 2.1.5. An attacker could exploit this vulnerability to view arbitrary files...

Indexhibit 跨站脚本漏洞

Indexhibit, a web-based content management system, is vulnerable to a stored cross-site scripting vulnerability in the Sections module in Indexhibit version 2.1.5. An attacker can exploit this vulnerability to execute arbitrary web script or HTML...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin W3 Total Cache prior to version...

Authentication flaw

Broken Authentication in Atlassian Connect Spring Boot ACSB in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Sprin...

CVE-2020-23534

A server-side request forgery SSRF vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter...

CVE-2020-23534

A server-side request forgery SSRF vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter...

CVE-2020-23534

CVE-2020-23534 is a server-side request forgery (SSRF) vulnerability affecting gopeak masterlab 2.1.5, exploitable via the 'source' parameter in Upgrade.php. The connected records confirm this specific vulnerable component and parameter; no additional exploit details, affected versions beyond 2.1...

CVE-2020-17532

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5...

CVE-2020-17532 Apache ServiceComb Yaml remote deserialization vulnerability

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5...

CVE-2020-14194

Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link...

Cross site scripting

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

CVE-2020-12759

CVE-2020-12759 affects Zulip Server prior to 2.1.5, with a reflected XSS vulnerability via the Dropbox webhook. Public records across NVD/Red Hat OSV/CVE entries confirm the issue in Zulip Server before 2.1.5 and indicate the root cause as unsafe handling of the webhook payload leading to cross-s...

Zulip Server Cross-Site Scripting Vulnerability (CNVD-2020-49009)

Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Server is the Zulip server. A reflective cross-site scripting vulnerability exists in Zulip Server versions prior to 2.1.5. An attacker ca...