7789 matches found
Server side request forgery (ssrf)
Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x i...
Xxe
Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity XXE processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201...
CVE-2022-29943
Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity XXE processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201...
CVE-2022-29943
CVE-2022-29943 (Talend Administration Center) and CVE-2022-29942 describe authenticated vulnerabilities in Talend Administration Center. The CVE-29943 issue allows XML External Entity (XXE) processing that can read the remote filesystem as root; a separate CVE-29942 concerns SSRF via the Service ...
CVE-2022-29942
Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x i...
CVE-2022-29942
Talend Administration Center {CVE-2022-29942} is a SSRF vulnerability: an authenticated user can use the Service Registry 'Add' function to perform HTTP GETs to internal-network URLs. The issue is fixed in 8.0.x (TPS-5189), 7.3.x (TPS-5175), and 7.2.x (TPS-5201); earlier versions may be affected....
CVE-2021-42235
SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality...
CVE-2021-42235
SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality...
Talend Administration Center 代码问题漏洞
Talend Administration Center is a web-based application from Talend that allows centralized studio management. A security vulnerability exists in Talend Administration Center that originates from the use of the "Add" function of the service registry to perform cross-site request forgery of HTTP G...
Talend Administration Center 代码问题漏洞
Talend Administration Center is a web-based application from Talend that centralizes studio management. A security vulnerability exists in Talend Administration Center. An attacker exploits the vulnerability to use XML External Entities XXE to achieve root read access on a remote file system...
GHSA-678X-XFP4-R92R Apache Geronimo Application Server CSRF vulnerabilities
Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that 1 change the web administration password, 2 upload application...
Apache Geronimo Application Server CSRF vulnerabilities
Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that 1 change the web administration password, 2 upload application...
GHSA-C372-X57P-6X7V Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 ip, 3 username, or 4 description parameter to console/portal/Server/Monitorin...
Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 ip, 3 username, or 4 description parameter to console/portal/Server/Monitorin...
GHSA-R5CJ-WV24-92P5 Django cross-site request forgery (CSRF) vulnerability
The administration application in Django 0.91.x, 0.95.x, and 0.96.x stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery CSRF attacks and delete or modify data via unspecified...
Django cross-site request forgery (CSRF) vulnerability
The administration application in Django 0.91.x, 0.95.x, and 0.96.x stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery CSRF attacks and delete or modify data via unspecified...
Django Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...
GHSA-54QJ-48VX-CR9F Django Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...
Django Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...
