380 matches found
Design/Logic Flaw
A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that contains HTML and javascript in its name. A malicious user can upload a file with a malicious filename containing javascript code and it will run on any user...
CVE-2021-40966
A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that contains HTML and javascript in its name. A malicious user can upload a file with a malicious filename containing javascript code and it will run on any user...
CVE-2021-40966
A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that contains HTML and javascript in its name. A malicious user can upload a file with a malicious filename containing javascript code and it will run on any user...
PT-2021-23020
Name of the Vulnerable Software and Affected Versions TinyFileManager versions up to and including 2.4.6 Description A Cross-Site Request Forgery CSRF issue exists that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacke...
PT-2021-23019
Name of the Vulnerable Software and Affected Versions TinyFileManager versions up to and including 2.4.6 Description A Path Traversal issue exists that allows attackers to upload a file with the fullpath parameter containing path traversal strings ../ and .. to escape the server's intended workin...
TinyFileManager 路径遍历漏洞
TinyFileManager is a web-based file manager used to store, upload, edit and manage files and folders online via a web browser. A path traversal vulnerability exists in TinyFileManager 2.4.6 and all versions below, which stems from the software's lack of validation and escaping of the fullpath...
WordPress GetPaid 2.4.6 HTML Injection
Exploit Title: WordPress Plugin Payments Plugin | GetPaid 2.4.6 - HTML Injection Date: 29/08/2021 Exploit Author: Niraj Mahajan Software Link: https://wordpress.org/plugins/invoicing/ Version: 2.4.6 Tested on Windows Steps to Reproduce: 1. Install Wordpress 5.8 2. Install and Activate "WordPress...
KevinLAB BEMS 1.0 - File Path Traversal Information Disclosure (Authenticated)
Exploit Title: KevinLAB BEMS 1.0 - File Path Traversal Information Disclosure Authenticated Date: 05.07.2021 Exploit Author: LiquidWorm Vendor Homepage: http://www.kevinlab.com Vendor: KevinLAB Inc. Product web page: http://www.kevinlab.com Affected version: 4ST L-BEMS 1.0.0 Building Energy...
Apache HTTP Server 2.4.6 - 2.4.46 Tunneling Misconfiguration Vulnerability - Windows
Apache HTTP Server is prone to a tunneling misconfiguration vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
Vaadin flow 安全漏洞
Vaadin flow is a software application, a Java framework for the Vaadin platform, for building modern websites that look good, perform well, and keep you and your users happy. A security vulnerability exists in Vaadin flow that allows an attacker to guess a security token via a timing attack. The...
httpd security and bug fix update
2.4.6-90.0.1 - replace index.html with Oracles index page oracleindex.html Resolves: 1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation in modauthdigest - Resolves: 1696141 - CVE-2019-0217 httpd: modauthdigest: access control bypass due to race condition - Resolves: 1696096 -...
SpotMSN 2.4.6 - Denial of Service Exploit
Exploit Title: SpotMSN 2.4.6 - 'Name/Key' Denial of Service PoC Discovery by: Victor Mondragón Vendor Homepage: www.nsauditor.com Software Link: http://www.nsauditor.com/downloads/spotmsnsetup.exe Tested Version: 2.4.6 Tested on: Windows Windows 10 Single Language x64 / 7 x64 Service Pack 1 Steps...
SpotMSN 2.4.6 - Denial of Service (PoC)
Exploit Title: SpotMSN 2.4.6 - 'Name/Key' Denial of Service PoC Discovery by: Victor Mondragón Discovery Date: 2019-05-12 Vendor Homepage: www.nsauditor.com Software Link: http://www.nsauditor.com/downloads/spotmsnsetup.exe Tested Version: 2.4.6 Tested on: Windows Windows 10 Single Language x64 /...
SpotMSN 2.4.6 Denial Of Service
Exploit Title: SpotMSN 2.4.6 - 'Name/Key' Denial of Service PoC Discovery by: Victor Mondragón Discovery Date: 2019-05-12 Vendor Homepage: www.nsauditor.com Software Link: http://www.nsauditor.com/downloads/spotmsnsetup.exe Tested Version: 2.4.6 Tested on: Windows Windows 10 Single Language x64 /...
FrontAccounting SQL Injection Vulnerability
FrontAccounting FA is FrontAccounting's suite of financial software for the ERP supply chain of small and medium-sized businesses. The software includes modules for Purchase Orders, Merchandise Tickets, and Account Sorting and Budgeting. A SQL injection vulnerability exists in the...
Jinjava calls getClass
Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java...
CVE-2018-14380
In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts...
CVE-2018-14380
In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts...