886 matches found
CVE-2020-23686
Cross site request forgery CSRF vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified impacts...
Cross site request forgery (csrf)
Cross site request forgery CSRF vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified impacts...
CVE-2020-23686
Cross site request forgery CSRF vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified impacts...
CVE-2020-23686
CVE-2020-23686 affects AyaCMS 3.1.2 and is a Cross-Site Request Forgery (CSRF) flaw stemming from the software’s lack of CSRF protection during administrator password changes, enabling an attacker to change the admin password (and potentially other impacts) as described in multiple security recor...
CVE-2021-38295
In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will b...
PT-2021-22017 · Apache · Apache Couchdb
Name of the Vulnerable Software and Affected Versions: Apache CouchDB versions prior to 3.1.2 Description: A malicious user with permission to create documents in a database can attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, any JavaScript code...
Cybozu Remote Service 路径遍历漏洞
Cybozu Remote Service is a remote service management software from Cybozu Japan. It is used to access Cybozu's internal system. A security vulnerability exists in Cybozu Remote Service version 3.1.2. The vulnerability can be exploited by attackers to conduct denial of service attacks...
PT-2021-20902 · Owasp · Owasp Modsecurity Core Rule Set
Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set versions 3.1.x through 3.1.1 OWASP ModSecurity Core Rule Set versions 3.2.x through 3.2.0 OWASP ModSecurity Core Rule Set versions 3.3.x through 3.3.1 Description: The issue is related to a Request Body Bypass...
Vulnerability fixed in VMware NSX-T
VMware has fixed a vulnerability in NSX-T. A authenticated malicious party can, by exploiting this vulnerability to gain elevated privileges on the vulnerable system. VMware has released updates to fix the vulnerability in NSX-T 3.1.2. For more information, see:...
[SECURITY] [DSA 4892-1] python-bleach security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4892-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 18, 2021 https://www.debian.org/security/faq -...
CVE-2021-29438
The Nextcloud dialogs library npm package @nextcloud/dialogs before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. The vulnerability has been patched in version 3.1.2 If you need to...
CVE-2021-29438
The Nextcloud dialogs library npm package @nextcloud/dialogs before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. The vulnerability has been patched in version 3.1.2 If you need to...
CVE-2021-29438 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs
The Nextcloud dialogs library npm package @nextcloud/dialogs before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. The vulnerability has been patched in version 3.1.2 If you need to...
CVE-2021-29438
The CVE-2021-29438 issue affects the npm package @nextcloud/dialogs (Nextcloud dialogs library) prior to version 3.1.2 , where text input displayed in a toast was insufficiently escaped, enabling a potential XSS vector in applications showing user-supplied input in toasts. The vulnerability is mi...
Nextcloud 安全漏洞
Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in the Nextcloud dialogs library prior to version 3.1.2, which stems from an insufficient escape passed to toast. It can le...
UBUNTU-CVE-2021-21416
django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registration view did not properly apply filters...
CVE-2020-24995
Buffer overflow vulnerability in sniffchannelorder function in aacdectemplate.c in ffmpeg 3.1.2, allows attackers to execute arbitrary code local...
CVE-2020-24995
FFmpeg 3.1.2 is affected by a buffer overflow in the sniff_channel_order function of aacdec_template.c, enabling local arbitrary code execution. The Connected documents confirm the vulnerable component and impact, but no remediation details are provided in the supplied sources; consult linked tic...
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget
In the plugin, the image box widget includes/widgets/image-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘savebuilder’ request containing JavaScript ...
Denial of Service in @hapi/ammo
Versions of @hapi/ammo prior to 3.1.2 or 5.0.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error ...