728 matches found
Cross site scripting
An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter...
Code injection
An issue was discovered in Eventum 3.5.0. /htdocs/list.php has XSS via the shownotificationlistissues or showauthorizedissues parameter...
Design/Logic Flaw
An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...
Code injection
An issue was discovered in Eventum 3.5.0. htdocs/switch.php has XSS via the currentpage parameter...
Cross site request forgery (csrf)
An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privileges...
CVE-2018-12628
Eventum 3.5.0 is affected by a CSRF vulnerability in htdocs/manage/users.php that allows an attacker to create another user with admin privileges. This CVE-2018-12628 entry documents the issue and its impact: unauthorized account creation with admin rights via CSRF, enabling partial/high impact c...
CVE-2018-12626
Eventum 3.5.0 is affected by a cross-site scripting vulnerability in /htdocs/popup.php via the cat parameter. Impact is described as client-side code execution with partial integrity impact (per CVE notes). Connected advisories from Red Hat and CNVD/EUVD mirrors confirm the same issue exists in E...
CVE-2018-12626
An issue was discovered in Eventum 3.5.0. /htdocs/popup.php has XSS via the cat parameter...
CVE-2018-12625
An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter...
CVE-2018-12625
CVE-2018-12625 affects Eventum 3.5.0, with an XSS vulnerability in /htdocs/validate.php via the values parameter. The connected sources corroborate a client-side data validation issue in Eventum 3.5.0; no further exploit details are provided in the provided documents. The NVD entry lists a CVSS v...
CVE-2018-12622
An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...
CVE-2018-12622
Eventum 3.5.0 is affected by an XSS in htdocs/ajax/update.php via the field_name parameter. The issue is reflected XSS with potential impact on confidentiality/integrity (per CVSSv3 6.1, MEDIUM). No exploit details or patch version are provided in the documents; a later release 3.5.2 is reference...
CVE-2019-13337
In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter accesstoken this is the parameter used by the API. No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is...
CVE-2018-12621
An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...
CVE-2018-12621
An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...
Open redirect
An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...
CVE-2018-12621
An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...
Eventum Cross-Site Scripting Vulnerability
Eventum is a defect tracking system. The system is used to track inbound technical support, organizational tasks, bugs, etc. A cross-site scripting vulnerability exists in the /htdocs/postnote.php file in Eventum version 3.5.0. The vulnerability stems from a lack of proper validation of client-si...
Access control bypass in Apache ZooKeeper
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...