28055 matches found
CVE-2012-4378
CVE-2012-4378 involves multiple XSS vulnerabilities in MediaWiki exploited when unspecified JavaScript gadgets are used. Affected are MediaWiki versions before 1.18.5 and 1.19.x before 1.19.2 . The flaw allows remote attackers to inject arbitrary web script or HTML via the userlang parameter to w...
CVE-2012-1622
CVE-2012-1622 affects Apache OFBiz 10.04.x before 10.04.02 and allows remote attackers to execute arbitrary code via unspecified vectors. The vulnerability is described as a remote code execution issue with high impact (network access, no auth required; exploits possible without user interaction)...
CVE-2012-4377
Cross-site scripting XSS vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image...
GHSA-76WQ-XW4H-F8WJ activerecord vulnerable to SQL Injection
The Active Record component in Ruby on Rails efore 2.3.15, 3.0.x before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via...
GHSA-Q34C-48GC-M9G8 actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...
actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...
GHSA-HGPP-PP89-4FGF Action Pack contains database-query restrictions bypass
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to...
Action Pack contains database-query restrictions bypass
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to...
activerecord vulnerable to SQL Injection
The Active Record component in Ruby on Rails efore 2.3.15, 3.0.x before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via...
Unsafe Query Generation Risk in Ruby on Rails
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...
actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...
argentavis.org XSS vulnerability
Open Bug Bounty ID: OBB-361204 Description| Value ---|--- Affected Website:| argentavis.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...
CVE-2012-4570
SQL injection vulnerability in LetoDMSCore/Core/inc.ClassDMS.php in LetoDMS formerly MyDMS before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2012-4569
Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2012-4569
CVE-2012-4569 affects LetoDMS (formerly MyDMS) before 3.3.9. The vulnerability is in out/out.UsrMgr.php and permits remote XSS via unspecified vectors, allowing injection of arbitrary web script/HTML. Affected software/function: LetoDMS web interface; vulnerable component/file: out/out.UsrMgr.php...
CVE-2012-4570
Summary: CVE-2012-4570 affects LetoDMS (formerly MyDMS) up to version 3.3.7, due to an SQL injection in LetoDMS_Core/Core/inc.ClassDMS.php that allows remote attackers to execute arbitrary SQL commands via unspecified vectors. What’s affected: LetoDMS (PHP+MySQL) deployments prior to 3.3.8. Root ...
CVE-2012-4568
The vulnerability CVE-2012-4568 affects LetoDMS (formerly MyDMS) prior to version 3.3.8. Multiple cross-site request forgery (CSRF) flaws allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. The root cause is CSRF in the web application’s handling of aut...
CVE-2012-4567
LetoDMS (formerly MyDMS) before 3.3.8 contains multiple XSS vulnerabilities reachable via parameters in inc/inc.ClassUI.php and out/out.DocumentNotify.php. The issue, confirmed across CVE-2012-4567 entries, allows remote attackers to inject arbitrary scripts/HTML (no exploit details provided). Af...
GLSA-201710-21 : Kodi: Arbitrary code execution
The remote host is affected by the vulnerability described in GLSA-201710-21 Kodi: Arbitrary code execution Kodi is vulnerable due to shipping with an embedded version of UnRAR. Please review the referenced CVE identifier for details. Impact : A remote attacker, by enticing a user to process a...