116 matches found
CVE-2020-5554
Directory traversal vulnerability in Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write arbitrary files via unspecified vectors...
EKAKIN Shihonkanri Plus GOOUT Input Validation Error Vulnerability
EKAKIN Shihonkanri Plus GOOUT is a CGI Common Gateway Interface from EKAKIN Japan. An input validation error vulnerability exists in EKAKIN shihonkanri Plus GOOUT versions 1.5.8 and 2.2.10. The vulnerability originates from a network system or product that does not properly validate incoming data...
EKAKIN Shihonkanri Plus GOOUT Path Traversal Vulnerability
EKAKIN Shihonkanri Plus GOOUT is a CGI Common Gateway Interface from EKAKIN Japan. A path traversal vulnerability exists in EKAKIN shihonkanri Plus GOOUT versions 1.5.8 and 2.2.10. The vulnerability stems from a failure of a network system or product to properly filter special elements in the pat...
EKAKIN Shihonkanri Plus GOOUT Operating System Command Injection Vulnerability
EKAKIN Shihonkanri Plus GOOUT is a CGI Common Gateway Interface from EKAKIN Japan. An operating system command injection vulnerability exists in EKAKIN Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10. A remote attacker could exploit this vulnerability to execute arbitrary operating system commands...
Django SQL Injection Vulnerability (CNVD-2020-04524)
Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes object-oriented mapper , view system , template system and so on. A SQL injection vulnerability exists in Django versions 1.11 before 1.11.28, 2.2 before 2.2.10, an...
Magento Untrusted Data Deserialization Vulnerability
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. An untrusted data deserialization vulnerability exists in Magento versions 2.3.3 and earlier, 2.2.10 and earlier,...
Django -- potential SQL injection vulnerability
MITRE CVE reports: Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitabl...
CVE-2020-3717
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could lead to sensitive information disclosure...
PT-2020-17698 · Adobe · Magento
Name of the Vulnerable Software and Affected Versions: Magento versions 2.3.3 and earlier Magento versions 2.2.10 and earlier Magento versions 1.14.4.3 and earlier Magento versions 1.9.4.3 and earlier Description: The issue is a stored cross-site scripting vulnerability. Successful exploitation...
PT-2020-17699 · Adobe · Magento
Name of the Vulnerable Software and Affected Versions: Magento versions 2.3.3 and earlier Magento versions 2.2.10 and earlier Magento versions 1.14.4.3 and earlier Magento versions 1.9.4.3 and earlier Description: The issue is related to the deserialization of untrusted data, which could lead to...
PT-2020-17702 · Adobe · Magento
Name of the Vulnerable Software and Affected Versions: Magento versions 2.3.3 and earlier Magento versions 2.2.10 and earlier Magento versions 1.14.4.3 and earlier Magento versions 1.9.4.3 and earlier Description: The issue is related to an sql injection vulnerability. Successful exploitation cou...
Aviatrix VPN Client Privilege Handling Elevation of Privilege Vulnerability
Aviatrix VPN Client is a VPN Virtual Private Network client application that provides SAML authentication. A security vulnerability exists in Aviatrix VPN Client version 2.2.10 and earlier, which stems from the program assigning weak file permissions to the installation path. A local attacker can...
CVE-2019-8107
An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with export data transfer privileges can craft a request to perform arbitrary file deletion...
PRODSECBUG-2344: Cross-Site Scripting via wysiwyg editor
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2417: Remote code execution via vulnerable Symphony dependecy injection
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2414: Remote code execution through custom layout update of the content management functionality
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2223: Remote code execution when using functionality that imports a new product
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2446: Remote code execution via custom layout update in create product functionality
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...