CVE-2020-11822

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure -- user access groups page. Thus, an attacker can inject malicious script to steal all users' valuable data...

CVE-2020-11822

CVE-2020-11822 affects Rukovoditel 2.5.2. The vulnerability is a stored XSS on the Application Structure module, specifically the User Access Groups page, enabling an attacker to inject malicious script and potentially steal user data. The connected documents do not provide specific exploit code,...

Rukovoditel Input Validation Error Vulnerability

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . An input validation error vulnerability exists in Rukovoditel version 2.5.2. An attacker can exploit th...

CVE-2020-11813

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

CVE-2020-11815

In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value. As a result of that, an attacker can execute a command on the server. This specific attack only occurs without the Maintenance Mode setting...

CVE-2020-11812

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters0value or filters1value parameter...

CVE-2020-11820

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entitiesid parameter...

CVE-2020-11812

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters0value or filters1value parameter...

Sql injection

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reportsid POST parameter...

Sql injection

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters0value or filters1value parameter...

Command injection

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution...

Code injection

In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value. As a result of that, an attacker can execute a command on the server. This specific attack only occurs without the Maintenance Mode setting...

Cross site request forgery (csrf)

In Rukovoditel 2.5.2 has a formsessiontoken value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges...

CVE-2020-11819

CVE-2020-11819 affects Rukovoditel up to version 2.5.2. The vulnerability arises from an input-validation/weak path handling flaw that lets an attacker inject an arbitrary .php file location in place of a language file, enabling remote command execution via local file inclusion. Public references...

CVE-2020-11820

CVE-2020-11820 affects Rukovoditel 2.5.2 with a SQL injection vulnerability caused by improper handling of the entities_id parameter. The CVE entry indicates high/critical impact (CVSS v3.1 base 9.8; network vector, no auth, user interaction not required) and mentions no exploitation details or p...

CVE-2020-11820

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entitiesid parameter...

CVE-2020-11816

CVE-2020-11816 affects Rukovoditel 2.5.2, where SQL injection arises from improper handling of the reports_id POST parameter. The vulnerability enables manipulation of SQL queries via user-supplied input, with CVSS indicating high to critical impact (CVSS v2 base 7.5; CVSS v3.1 base 9.8). Exploit...

CVE-2020-11812

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters0value or filters1value parameter...

CVE-2020-11813

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

Security Bulletin: IBM QRadar Advisor With Watson App for IBM QRadar SIEM is vulnerable to information exposure (CVE-2019-4672)

Summary IBM QRadar Advisor with Watson App for IBM QRadar SIEM could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests that could aid in further attacks against the system. Vulnerability Details CVEID: CVE-2019-4672 DESCRIPTION: IBM QRadar Advisor...