Emlog 代码问题漏洞

emlog is a powerful blog and CMS builder based on PHP and MySQL. A remote code execution vulnerability exists in emlog versions 5.3.1, 6.0.0. The vulnerability stems from uploading a database backup file in admin/data.php. An attacker can exploit this vulnerability to achieve remote code executio...

Security Bulletin: Clickjack vulnerability affects multiple IBM Rational products based on IBM Jazz technology (CVE-2015-1928)

Summary A vulnerability in the IBM Jazz Foundation affects the following IBM Jazz Team Server based Applications: Collaborative Lifecycle Management CLM, Rational Requirements Composer RRC, Rational DOORS Next Generation RDNG, Rational Engineering Lifecycle Manager RELM, Rational Team Concert RTC...

Cross site request forgery (csrf)

Authentication.logout helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 Vaadin 18, and 6.0.0 through 6.0.4 Vaadin 19.0.0 through 19.0.3 uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the...

Cross site request forgery (csrf)

Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 Vaadin 15.0.0 through 18.0.6, and com.vaadin:fusion-endpoint version 6.0.0 Vaadin 19.0.0 allows attacker to guess a security token for Fusion endpoints via timing attack...

PT-2021-19288 · Vaadin · Com.Vaadin:Flow-Server

Name of the Vulnerable Software and Affected Versions: com.vaadin:flow-server versions 1.2.0 through 2.4.7 com.vaadin:flow-server versions 6.0.0 through 6.0.1 Description: The issue allows an attacker to access application classes and resources on the server via a crafted HTTP request. This is du...

PT-2021-7719

Name of the Vulnerable Software and Affected Versions QEMU versions up to 6.0.0 Description A heap buffer overflow was found in the floppy disk emulator of QEMU. It could occur in fdctrl transfer handler in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest...

Security Bulletin: Security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Security Identity Manager(CVE-2020-4949)

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Identity Manager ISIM. Information about security vulnerabilitiy affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

OpenEMR 2.7.3-rc1 < 6.0.0.1 XSS Vulnerability

OpenEMR is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr";...

OpenEMR 4.2.0 < 6.0.0.1 XSS Vulnerability

OpenEMR is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr";...

CVE-2021-25922

In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting XSS due to user input not being validated properly. An attacker could trick a user to click on a malicious url and execute malicious code...

CVE-2021-25919

In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...

CVE-2021-25918

In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...

Cross site scripting

In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...

CVE-2021-25917

OpenEMR (versions 5.0.2–6.0.0) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is that user input is not properly validated and is rendered on the U2F USB Device authentication method page, allowing a highly privileged attacker to inject arbitrary code when creating a ne...

OpenEMR 跨站脚本漏洞

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A cross-site scripting vulnerability exists in OpenEMR versions 4.2.0 - 6.0.0. The vulnerability stems from not properly validating user input. An attacker can exploit the vulnerability to execute...

Apache OpenMeetings 4.0.0 - 5.1.0 DoS Vulnerability

Apache OpenMeetings is prone to a denial of service vulnerability in the NetTest web service. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

CVE-2021-27576

If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0...

Code injection

If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0...

Security fix for the ALT Linux 10 package dotnet-bootstrap-6.0 version 6.0.0.preview.1-alt1

Feb. 23, 2021 Vitaly Lipatov 6.0.0.preview.1-alt1 Wed Feb 17 2021 Vitaly Lipatov &[email protected] 5.0.3-alt1 - .NET 5.0.3 and .NET SDK 5.0.103 - CVE-2021-1721: .NET Core Denial of Service Vulnerability - CVE-2021-24112: .NET 5 and .NET Core Remote Code Execution Vulnerability...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Security Identity Manager

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Identity Manager ISIM. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...