PT-2024-14127 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.23.3 and 2.24.0 Description: A stored cross-site scripting XSS vulnerability exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/lege...

Odoo 安全漏洞

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python language with PostgreSQL as the database and includes modules for sales management, inventory management, and financial management. A security...

PT-2022-25331 · Unknown · Application

Name of the Vulnerable Software and Affected Versions: Application affected versions not specified Description: The issue allows authenticated information disclosure, enabling administrators to view unsalted user passwords. This could lead to the compromise of plaintext passwords via offline...

CVE-2021-40694

Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account...

CVE-2022-3142

The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured...

CVE-2022-26415

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance...

Cloudera Data Engineering 信息泄露漏洞

Cloudera Data Engineering is a service-less architecture cloud service from Cloudera, USA that supports the creation of Apache Spark tasks on a cloud platform. A security vulnerability exists in Cloudera Data Engineering CDE version 1.3.0 that stems from a JWT authentication token being exposed t...

CVE-2019-12863

SolarWinds Orion Platform 2018.4 HF3 NPM 12.4, NetPath 1.1.4 allows Stored HTML Injection by administrators via the Web Console Settings screen...

Atlassian Jira 8.4.x < 8.4.1 Template Injection Vulnerability

According to its self-reported version number, the Atlassian Jira application running on the remote host is 7.0.10 7.6.16, 7.7.x 7.13.8, 8.1.x 8.1.3, 8.2.x 8.2.5, 8.3.x 8.3.4, 8.4.x 8.4.1. It is, therefore, affected by a server-side template injection vulnerability that exists in the Jira Importe...

Atlassian Jira 7.0.10 < 7.6.16 Template Injection Vulnerability

According to its self-reported version number, the Atlassian Jira application running on the remote host is 7.0.10 7.6.16, 7.7.x 7.13.8, 8.1.x 8.1.3, 8.2.x 8.2.5, 8.3.x 8.3.4, 8.4.x 8.4.1. It is, therefore, affected by a server-side template injection vulnerability that exists in the Jira Importe...

Atlassian Jira 8.3.x < 8.3.4 Template Injection Vulnerability

According to its self-reported version number, the Atlassian Jira application running on the remote host is 7.0.10 7.6.16, 7.7.x 7.13.8, 8.1.x 8.1.3, 8.2.x 8.2.5, 8.3.x 8.3.4, 8.4.x 8.4.1. It is, therefore, affected by a server-side template injection vulnerability that exists in the Jira Importe...

The vulnerability of the platform for automating operations in healthcare institutions of the Russian Federation’s entity Tra: The lack of a CSRF token in web forms allows actions to be performed on behalf of users, including administrators.

The vulnerability of the platform for automating operations in healthcare institutions of the Russian Federation’s Tra: Pharmaceutical Supply relates to the absence of a CSRF token in web forms. Exploiting this vulnerability allows a malicious actor to execute cross-site requests on behalf of...

Atlassian JIRA 7.6.x < 7.6.14, 7.13.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3 RCE

Binary data 700899.prm...

CVE-2019-11581 - Template injection in various resources

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. For this issue to be exploitable at least one of the following conditions must be met: an SMTP server has been configured in Jira and the Contact...

CVE-2018-1214

Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of the installation process. This unnecessary user account also remains even after an upgrade from v1.1 to v1.2. Access to the management console can be achiev...