WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. WordPress WP SEO Tags plugin has a security...

PT-2021-14717 · Jenkins · Jenkins Requests-Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins requests-plugin Plugin versions 2.2.6 and earlier Description: A missing permission check in the Jenkins requests-plugin Plugin allows attackers with Overall/Read permission to view the list of pending requests. This issue is related ...

PT-2021-14719 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins requests-plugin Plugin versions 2.2.7 and earlier Description: The issue is related to a missing permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to send test emails to an attacker-specified email...

CVE-2020-27601

In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js...

Server side request forgery (ssrf)

BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field...

PT-2020-16711 · Bigbluebutton · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.2.7 Description: The issue arises from the lockSettingsProps.disablePrivateChat setting not being applied to chats that are already open. This problem is located in the...

PT-2020-16712 · Bigbluebutton · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.2.7 Description: The issue is related to a lack of protection mechanism for separator injection in meetingId, userId, and authToken. This affects the security of the system. Recommendations: For versions prio...

Dovecot < 2.2.7 Authentication Bypass Vulnerability

Dovecot is prone to an authentication bypass vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

CVE-2016-10975

The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter...

CVE-2018-20843

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing enough to be usable for denial-of-service attacks...

Sql injection

SQL Injection exists in the Jimtawl 2.2.7 component for Joomla! via the id parameter...

CVE-2018-17399

CVE-2018-17399 affects the Jimtawl 2.2.7 component for Joomla! via the id parameter, enabling SQL injection. The issue is documented across multiple feeds (e.g., Red Hat, CNVD, NVD, CVE List) as a SQL injection vulnerability with high to critical impact; exploitation details are referenced in Exp...

Nagios IM SQL Injection Vulnerability

Nagios Incident Manager IM is a network time manager from the US-based Nagios. The product is primarily used to manage and track network event history. A SQL injection vulnerability exists in Nagios IM versions prior to 2.2.7. A remote attacker can exploit this vulnerability to execute arbitrary...

Nagios IM Authorization Bypass Vulnerability

Nagios Incident Manager IM is a network time manager from the US-based Nagios. The product is primarily used to manage and track network event history. A security vulnerability exists in Nagios IM versions prior to 2.2.7. An attacker can exploit this vulnerability to perform unauthorized operatio...

PT-2019-19434 · Nagios · Nagios Xi +1

Name of the Vulnerable Software and Affected Versions: Nagios IM versions prior to 2.2.7 Description: The issue allows for authorization bypass in Nagios IM, a component of Nagios XI, enabling the closure of incidents via the API. Recommendations: For versions prior to 2.2.7, update to version...

PT-2019-19435 · Nagios · Nagios Im

Name of the Vulnerable Software and Affected Versions: Nagios IM versions prior to 2.2.7 Description: A SQL injection issue allows attackers to execute arbitrary SQL commands. Recommendations: For versions prior to 2.2.7, update to version 2.2.7 or later to resolve the issue...

PT-2019-19433 · Nagios · Nagios Im

Name of the Vulnerable Software and Affected Versions: Nagios IM versions prior to 2.2.7 Description: The issue allows authenticated users to execute arbitrary code due to API key problems. Recommendations: For versions prior to 2.2.7, update to version 2.2.7 or later to resolve the issue...

Ricoh myPrint Information Disclosure Vulnerability

Ricoh myPrint is a mobile printing application from Ricoh Japan. A security vulnerability exists in Ricoh myPrint version 2.9.2.4 for Windows-based platforms and myPrint version 2.2.7 for Android-based platforms, which stems from the program's use of hard-coded credentials. The vulnerability can ...

CMS Made Simple 2.2.7 - (Authenticated) Remote Code Execution

Exploit Title: CMS Made Simple 2.2.7 - Remote Code Execution Date: 2018-11-04 Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage: https://www.cmsmadesimple.org/ Software Link:...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2018-21249)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in the...