523 matches found
PT-2021-23436 · Mybb · Mybb
Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.28 Description: The issue allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly. Recommendations: For versions prior to 1.8.28, update to version 1.8....
Paypal Donation < 1.3.1 - CSRF to Arbitrary Post Deletion
The plugin provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could make logged in admins delete arbitrary posts PoC...
Nextcloud: Default settings leak federated cloud id to lookup server of all users
So with the default settings Nextcloud still sends requests to the lookup server if users update their profile. Even if none of the fields are set to 'published'. I must admit this is somewhat of a surprise as there is no reason for this. As long as the visibility of none of the fields change and...
CVE-2021-21286
AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...
CVE-2021-21286 Authorization Bypass in AVideo Platform
AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...
Design/Logic Flaw
Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel which will require a physical reset to restore administrative control via Randomnum=99AC8CEC6E845B28&mode=1 in a POST request to the cgi-bin/setfactory URI...
CVE-2020-29194
CVE-2020-29194 affects Panasonic Security System WV-S2231L (firmware 4.25). A denial-of-service of the admin control panel is possible via a POST to /cgi-bin/set_factory with Randomnum=99AC8CEC6E845B28&mode=1, requiring a physical reset to regain control. Documented impact: admin control panel un...
CVE-2020-13350
CVE-2020-13350 is a CSRF in GitLab CE/EE runner administration page affecting multiple versions: >=13.5.0, =13.4.0, <13.4.5;
phpBB: Server Side Request Forgery in 'Jabber settings' in Admin Control Panel
Overview The 'Jabber settings' panel inside the Administrator Control Panel can be used to access resources that would otherwise only be accessible by the host machine, including resources/services hosted on the localhost interface. This can be performed by setting the 'jabber server' parameter t...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50937)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP of vBulletin 5.6.3. The vulnerability can be exploited to conduct a cross-site scripting attack via the headings of the sub-help items in the "Login/Logout...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50936)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the Style Manager's Style Options Settin...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50939)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP of vBulletin 5.6.3. The vulnerability can be exploited to conduct cross-site scripting attacks via the "Pay to subscribe to email notifications" field in t...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50938)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited to conduct cross-site scripting attacks via the admincp/search.php?do=dosearch URI...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50935)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the Junior Member Title in the User Titl...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50940)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the Smilie title of Smilies Manager...
CVE-2020-25124
The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI...
CVE-2020-25124
The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI...
CVE-2020-25120
The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI...