585 matches found
GHSA-6J8F-66VH-39MJ Apache Tomcat Mishandles Character Sequence in Cookies
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...
CVE-2022-24643
A stored cross-site scripting XSS issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0...
UBUNTU-CVE-2021-23648
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting XSS due to improper sanitization in sanitizeUrl function...
OpenEMR <= 6.0.0 IDOR Vulnerability
OpenEMR is prone to an insecure direct object reference IDOR vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Design/Logic Flaw
An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...
CVE-2022-25471
CVE-2022-25471 : OpenEMR 6.0.0 contains an Insecure Direct Object Reference (IDOR). An authenticated attacker can access and modify unauthorized areas by sending a crafted POST to /modules/zend_modules/public/Installer/register. Root cause stated as IDOR; no exploit details or fixes are provided ...
CVE-2022-25471
An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...
Cross site scripting
The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...
radare2 代码问题漏洞
radare2 is a set of libraries and tools for working with binaries. A code issue vulnerability exists in radare2 that stems from the dereferencing of null pointers in the GitHub repository radareorg radare2 prior to 6.0.0...
Cross-site Scripting in Crater Invoice
Crater invoice prior to version 6.0.0 has a cross-site scripting vulnerability...
GHSA-6VFW-74WR-3CHH Cross-site Scripting in Crater Invoice
Crater invoice prior to version 6.0.0 has a cross-site scripting vulnerability...
Out-of-bounds
Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend called from QPainterPath::addPath and QPathClipper::intersect...
CVE-2021-45930
Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend called from QPainterPath::addPath and QPathClipper::intersect...
CVE-2021-4158
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition...
OpenEMR < 6.0.0 Patch 3 SQLi Vulnerability
OpenEMR is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr";...
CVE-2021-37102
There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful...
.NET 6.0 bugfix and enhancement update
An update is available for dotnet6.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This updates .NET 6 to SDK 6.0.100 RC 2 and Runtime 6.0.0 RC 2...
Alchemy CMS 6.0.0 Arbitrary File Upload
Exploit Title: AlchemyCMS 2.x to 6.0.0 - Unrestricted File Upload authenticated Date: 01/10/2021 Exploit Author: Abdulrahman https://twitter.com/infosec90 Vendor Homepage: https://alchemy-cms.com Software Link: https://github.com/AlchemyCMS/alchemycms Version: from 2.0 to 6.0.0 Tested on: Linux...