363 matches found
CVE-2021-23124
An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in modbreadcrumbs aria-label attribute allows XSS attacks...
CVE-2021-23124
An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in modbreadcrumbs aria-label attribute allows XSS attacks...
Joomla! 3.9.0 - 3.9.22 Information Disclosure Vulnerability
Joomla! is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...
PT-2021-15379 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.9.0 through 3.9.23 Description: The issue is related to a lack of escaping in the aria-label attribute of the mod breadcrumbs module, which allows XSS attacks. Recommendations: For Joomla! versions 3.9.0 through 3.9.23,...
User Enumeration Vulnerability in Joomla!
Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A user enumeration vulnerability exists in the back-end login page of Joomla!...
PT-2020-17366 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.9.0 through 3.9.22 Description: An issue was discovered that leads to a user enumeration attack vector in the backend login page due to improper handling of the username. Recommendations: For Joomla! versions 3.9.0 through...
Joomla! 信息泄露漏洞
Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A user enumeration vulnerability exists in the back-end login page of Joomla!...
CVE-2020-27730
In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities...
Code injection
In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities...
CVE-2020-27730
In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities...
ZeroShell 3.9.0 Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zeroshell 3.9.0 Remote Command Execution', 'Description' = %q This module exploits an unauthenticated command injection vulnerability found in...
ZeroShell 3.9.0 - (cgi-bin/kerbynet) Remote Root Command Injection Exploit
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zeroshell 3.9.0 Remote Command Execution', 'Description' = %q This module exploits an unauthenticated command injection vulnerability found in...
ZeroShell 3.9.0 - 'cgi-bin/kerbynet' Remote Root Command Injection (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zeroshell 3.9.0 Remote Command Execution', 'Description' = %q This module exploits an unauthenticated command injection vulnerability found in...
ChirpStack Network Server Denial of Service Vulnerability
ChirpStack Network Server is an open source LoRaWAN service for individual developers. The software is used in the wireless connectivity aspect of the Internet of Things and is characterized by low power consumption, long range and high capacity. A security vulnerability exists in ChirpStack...
A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
...
Server-side Request Forgery (SSRF)
Overview osm-static-maps is a Create a static image of a map with the features you want Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an...
GHSA-WVH7-5P38-2QFC Storing Password in Local Storage
The setPassword method http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.htmlsetPassword stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the...
PT-2020-8455
Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.9.0 Description: An issue was discovered when SAML is used, where encryption and signature verification are not mandatory. Recommendations: For versions prior to 3.9.0, update to version 3.9.0 or later to...
Sprout Forms Code Injection Vulnerability
Sprout Forms is a form builder plugin. A code injection vulnerability exists in Sprout Forms versions prior to 3.9.0. An attacker can exploit this vulnerability to execute Twig code...
Template injection
In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0...