openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting

Exploit Title: openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting Date: 13/03/2021 Exploit Author: Hosein Vita Vendor Homepage: https://www.openmaint.org/ Software Link: https://sourceforge.net/projects/openmaint/files/2.1/Core%20updates/openmaint-2.1-3.3.1/ Version: 2.1-3...

CVE-2020-20290

Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability...

CVE-2020-20289

Sql injection vulnerability in the yccms 3.3 project. The notop function's improper judgment of the request parameters, triggers a sql injection vulnerability...

CVE-2020-20287

Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request parameters, triggers remote code execution...

Unrestricted file upload

Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request parameters, triggers remote code execution...

Sql injection

Sql injection vulnerability in the yccms 3.3 project. The notop function's improper judgment of the request parameters, triggers a sql injection vulnerability...

CVE-2020-20287

CVE-2020-20287 affects the yccms 3.3 project, with an unrestricted file upload vulnerability in the internal xhUp function caused by its improper judgment of request parameters. This can lead to remote code execution. Exploitation details are not fully provided in the initial documents, but multi...

CVE-2020-20287

Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request parameters, triggers remote code execution...

CVE-2020-20289

CVE-2020-20289 affects yccms version 3.3, with the vulnerability in the no_top (no top) function where improper judgment of request parameters enables SQL injection. This is documented in PT-2021-10472, which describes how the issue arises from parameter handling and suggests a temporary workarou...

CVE-2020-20289

Sql injection vulnerability in the yccms 3.3 project. The notop function's improper judgment of the request parameters, triggers a sql injection vulnerability...

CVE-2020-20290

CVE-2020-20290 affects YCCMS 3.3. The issue is a directory traversal vulnerability caused by improper judgment of request parameters in the delete, deletesite, and deleteAll functions. This can allow unauthorized access to filesystem paths via crafted requests. Multiple sources (NVD, Red Hat advi...

CVE-2020-20290

Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability...

PT-2021-10471 · Yccms · Yccms

Name of the Vulnerable Software and Affected Versions: yccms version 3.3 Description: The issue is related to an unrestricted file upload vulnerability. It is caused by the xhUp function's improper judgment of the request parameters, which can trigger remote code execution. Recommendations: For...

PT-2021-10472 · Yccms · Yccms

Name of the Vulnerable Software and Affected Versions: yccms version 3.3 Description: The issue arises from the no top function's improper judgment of the request parameters, leading to a sql injection vulnerability. This allows for potential exploitation by manipulating request parameters...

CVE-2020-26280

OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting XSS. In the web applicatio...

PYSEC-2020-72

OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting XSS. In the web applicatio...

Foxit PhantomPDF Mac and Reader for Mac Buffer Overflow Vulnerability

Foxit PhantomPDF Mac and Foxit Reader for Mac are both China Foxit Foxit company's a macOS-based PDF document reader. A buffer overflow vulnerability exists in Foxit PhantomPDF Mac versions prior to 3.3 and Reader for Mac versions prior to 3.3. The vulnerability originates when a networked system...

BlogEngine 3.3 - (syndication.axd) XML External Entity Injection Vulnerability

Exploit for xml platform in category web applications Title: BlogEngine 3.3 - 'syndication.axd' XML External Entity Injection Author: Daniel Martinez Adan aDoN90 Homepage: https://blogengine.io/ Software Link: https://blogengine.io/support/download/ Affected Versions: 3.3 Vulnerability: XML...

BlogEngine 3.3 - 'syndication.axd' XML External Entity Injection

Title: BlogEngine 3.3 - 'syndication.axd' XML External Entity Injection Author: Daniel Martinez Adan aDoN90 Date: 2020-05-01 Homepage: https://blogengine.io/ Software Link: https://blogengine.io/support/download/ Affected Versions: 3.3 Vulnerability: XML External Entity XXE OOB Injection...

BlogEngine 3.3 XML Injection

Name: XML External Entity Injection OOB Vulnerability in BlogEngine 3.3 Affected Software: BlogEngine Affected Versions: 3.3 Homepage: https://blogengine.io/ Vulnerability: XML External Entity XXE OOB Injection Vulnerability Severity: High Status: Fixed Author: Daniel Martinez Adan aDoN90 CVSS...