CVE-2021-3164

ChurchRota 2.6.4 is vulnerable to authenticated remote code execution. The user does not need to have file upload permission in order to upload and execute an arbitrary file via a POST request to resources.php...

CVE-2021-3164

ChurchRota 2.6.4 is vulnerable to authenticated remote code execution. The user does not need to have file upload permission in order to upload and execute an arbitrary file via a POST request to resources.php...

Churchdesk Church Rota Code Issue Vulnerability

Churchdesk Church Rota is a software for managing church tasks, personnel and related information from Churchdesk USA. The software centralizes task management, personnel and related information, thus helping users to use it for managing staff and volunteers. A security vulnerability exists in...

ChurchRota 2.6.4 - RCE (Authenticated)

Exploit Title: ChurchRota 2.6.4 - RCE Authenticated Date: 1/19/2021 Exploit Author: Rob McCarthy @slixperi Vendor Homepage: https://github.com/Little-Ben/ChurchRota Software Link: https://github.com/Little-Ben/ChurchRota Version: 2.6.4 Tested on: Ubuntu import requests from pwn import listen...

Church Rota 2.6.4 Shell Upload

import requests from pwn import listen CVE-2021-3164 Church Rota version 2.6.4 is vulnerable to authenticated remote code execution. The user does not need to have file upload permission in order to upload and execute an arbitrary file. The application is written primarily with PHP so we use PHP ...

CVE-2019-6293 affecting package flex 2.6.4-6

CVE-2019-6293 affecting package flex 2.6.4-6. A patched version of the package is available...

Authentication flaw

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any...

PT-2020-20037 · Nextcloud +1 · Nextcloud Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client version 2.6.4 Description: The issue concerns a cleartext storage of sensitive information, which exposed details about used proxies and their authentication credentials. Recommendations: For Nextcloud Desktop Client...

Nextcloud Desktop Client Cross-Site Scripting Vulnerability

Nextcloud is a suite of client-server software for creating file hosting services and using them.Nextcloud Desktop Client is the Nextcloud desktop client. A cross-site scripting vulnerability exists in Nextcloud Desktop Client 2.6.4. An attacker can exploit this vulnerability via an invalid serve...

Cross site scripting

A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html including local links when responding with invalid data on the login attempt...

PT-2020-20013 · Nextcloud +1 · Nextcloud Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop client version 2.6.4 Description: A cross-site scripting error in the Nextcloud Desktop client allowed an attacker to present any HTML, including local links, when responding with invalid data on a login attempt...

CVE-2020-8229

A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system...

PT-2020-20041 · Nextcloud +1 · Nextcloud Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client version 2.6.4 Description: A memory leak in the OCUtil.dll library can lead to a Denial of Service DoS against the host system. Recommendations: For Nextcloud Desktop Client version 2.6.4, at the moment, there is no...

Combodo iTop Cross-Site Scripting Vulnerability (CNVD-2020-35968)

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management. A cross-site scripting vulnerability exists in the id of th...

Combodo iTop Cross-Site Scripting Vulnerability

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The tool provides incident management, configuration management and problem management. A cross-site scripting vulnerability exists in shortcut names ...

Cross site scripting

In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages community, essential, professional in version 2.7.0 and iTop essential and iTop professional in version 2.6.4...

CVE-2020-11697

In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages community, essential, professional for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4...

CVE-2020-11697

In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages community, essential, professional for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4...

Cross site scripting

In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages community, essential, professional for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4...

CVE-2020-11696

In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages community, essential, professional in version 2.7.0 and iTop essential and iTop professional in version 2.6.4...