Form Tools 安全漏洞

Form Tools is an open source code base for Form Tools scripts, modules, themes and APIs. A security vulnerability exists in Form Tools version 3.1.1 that originates from allowing an attacker to run arbitrary commands through the Group Name field under the Add Form section of the application...

CVE-2024-22719

SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client...

PT-2024-19542

Name of the Vulnerable Software and Affected Versions Form Tools version 3.1.1 Description A Server Side Template Injection SSTI issue allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application. Recommendations For Form Tools version 3.1.1,...

PT-2024-19537 · Unknown · Form Tools

Name of the Vulnerable Software and Affected Versions: Form Tools version 3.1.1 Description: A Cross Site Scripting XSS issue allows attackers to run arbitrary code via the client id parameter in the application URL. This enables attackers to potentially execute malicious scripts on the...

PT-2024-24526 · WordPress · Essential Grid Gallery

Name of the Vulnerable Software and Affected Versions: The Essential Grid Gallery WordPress Plugin versions up to, and including, 3.1.1 Description: The issue allows unauthenticated attackers to view private and password-protected posts that may contain sensitive information. This is possible due...

PT-2024-23449 · Landing · Landingi Landing Pages

Name of the Vulnerable Software and Affected Versions: Landingi Landing Pages versions n/a through 3.1.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application...

PT-2024-13409 · Itop +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 3.1.1 iTop versions prior to 3.2.0 Description: The issue allows an XSS attack to be performed when an object is displayed as an n:n relation item in another object, by filling malicious code in an object friendlyname o...

PT-2024-13462 · Itop +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 3.0.4 iTop versions prior to 3.1.1 Description: iTop is an IT service management platform. When dashlets are refreshed, XSS attacks are possible. Recommendations: For versions prior to 3.0.4, update to version 3.0.4 or...

CVE-2024-30221

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart.This issue affects Sunshine Photo Cart: from n/a through 3.1.1...

CVE-2024-30194

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Sunshine Sunshine Photo Cart allows Reflected XSS.This issue affects Sunshine Photo Cart: from n/a through 3.1.1...

PT-2024-23266 · Unknown · Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: Sunshine Photo Cart versions 3.1.1 and earlier Description: The issue is related to the deserialization of untrusted data. This can potentially lead to security risks. No information is provided about the estimated number of potentially...

WordPress Sunshine Photo Cart Plugin <= 3.1.1 is vulnerable to PHP Object Injection

Software Sunshine Photo Cart Type Plugin Vulnerable versions = 3.1.1 Fixed in 3.1.2 OWASP Top 10 A1: Broken Access Control Classification PHP Object Injection CVE CVE-2024-30221 Patch priority Medium CVSS severity Medium 5.4 Developer WP Sunshine PSID 7b2cd8d53b2f Credits CatFather Required...

VulnCheck KEV: CVE-2024-30221

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart.This issue affects Sunshine Photo Cart: from n/a through 3.1.1...

VulnCheck KEV: CVE-2024-30194

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through = 3.1.1...

PT-2024-20617 · Jquery · Quicksand Post Filter Jquery Plugin

Name of the Vulnerable Software and Affected Versions: Quicksand Post Filter jQuery Plugin versions 3.1.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in the Quicksand Post Filter jQuery Plugin. Recommendations: For Quicksand Post Filter jQuery Plugin...

CVE-2018-11694 affecting package reaper for versions less than 3.1.1-7

CVE-2018-11694 affecting package reaper for versions less than 3.1.1-7. A patched version of the package is available...

BIT-DISCOURSE-2023-40588 Discourse DoS via 2FA and Security Key Names

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...

BIT-DISCOURSE-2023-44388 Malicious requests can fill up the log files resulting in a deinal of service in Discourse

Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to...

CentOS 9 : python-oauthlib-3.1.1-5.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- oauthlib-3.1.1-5.el9 build changelog. - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker...

Apache Superset: Improper authorization validation on dashboards and charts import

A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be...