444 matches found
Awbs Advanced Webhost Billing System 跨站请求伪造漏洞
Awbs Advanced Webhost Billing System is a Php-based web billing management system for managed hosting from Awbs USA. The platform provides web hosting and or domain name registration business services, providing an automated solution for web hosting management. A cross-site request forgery...
Laravel Nova 3.7.0 Denial Of Service
Exploit Title: Laravel Nova 3.7.0 - 'range' DoS Date: June 22, 2020 Exploit Author: iqzer0 Vendor Homepage: https://nova.laravel.com/ Software Link: https://nova.laravel.com/releases Version: Version v3.7.0 Tested on: Manjaro / Chrome v83 An authenticated user can crash the application by setting...
MEMU PLAY 3.7.0 - (MEmusvc) Unquoted Service Path Vulnerability
Exploit Title: MEMU PLAY 3.7.0 - 'MEmusvc' Unquoted Service Path Exploit Author : SamAlucard Vendor : Microvirt Version : Microvirt MEMU 3.7.0 Vendor Homepage : https://www.memuplay.com/ Tested on OS: Windows 10 Home Analyze PoC : ============== C:\Users\Sam Sanzsc qc "MEmusvc" SC...
An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.
...
GHSA-2JPM-827P-J44G Stored XSS in TimelineJS3
Impact TimelineJS renders some user data as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most TimelineJS users...
CVE-2020-15092
Vulnerability summary (CVE-2020-15092) : TimelineJS
CVE-2020-15092 Stored XSS in TimelineJS3
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Mos...
Mattermost Server Authorization Issues Vulnerability
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.7.0 and 3.6.3. An attacker can exploit this vulnerability by using the API to create teams without authentication...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation...
Design/Logic Flaw
An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and exposed from the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is t...
Bolt CMS 3.7.0 - Authenticated Remote Code Execution Exploit
Exploit for php platform in category web applications Exploit Title: Bolt CMS 3.7.0 - Authenticated Remote Code Execution Exploit Author: r3m0t3nu11 Vendor Homepage: https://bolt.cm/ Software Link: https://bolt.cm/ Version: up to date and 6.x Tested on: Linux CVE : not-yet-0day last version p0c...
Joomla! access control error vulnerability (CNVD-2020-20998)
Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. An access control error vulnerability exists in the comfields SQL field in Joomla! versions 3.7.0 through 3.9.15, which can be exploited by attacker...
Bolt CMS Cross-Site Scripting Vulnerability (CNVD-2020-03554)
Bolt CMS is a PHP-based open source content management system for the Bolt community. A cross-site scripting vulnerability exists in Bolt CMS version 3.7.0. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabili...
CVE-2019-20058
Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the profiler page. NOTE: this is disputed because profiling was never intended for use in production. This is related to CVE-2018-12040...
CVE-2019-20058
Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the profiler page. NOTE: this is disputed because profiling was never intended for use in production. This is related to CVE-2018-12040...
CVE-2019-20058
CVE-2019-20058 affects Bolt 3.7.0 when the Symfony Web Profiler is enabled. The issue is an XSS vulnerability caused by unsanitized input (search?search=) being reflected on the profiler page; the vulnerability is disputed since the profiler is not intended for production use. Related to CVE-2018...
CVE-2019-20058
Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the profiler page. NOTE: this is disputed because profiling was never intended for use in production. This is related to CVE-2018-12040...
PT-2019-13812 · Radare2 +1 · Radare2 +1
Name of the Vulnerable Software and Affected Versions: radare2 versions prior to 3.7.0 Description: A command injection issue exists due to improper handling of symbol names embedded in executables. This allows for the execution of arbitrary shell commands with the permissions of the victim by...
Nextcloud Android app code injection vulnerability
Nextcloud Android app is an Android-based mobile application from Nextcloud Germany for accessing Nextcloud servers. A code injection vulnerability exists in versions of the Nextcloud Android app prior to 3.7.0, which arises from the failure of a network system or product to properly filter...