CVE-2021-4289: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. Affected by this vulnerability is the function post of the file omod/src/main/java/org/openmrs/module/referenceapplication/page/controller/UserAppPageController.java of the component...

CVE-2022-4216

The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebookappid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative...

CVE-2022-4216

The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebookappid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative...

PT-2022-26288 · WordPress · Chained Quiz

Name of the Vulnerable Software and Affected Versions: Chained Quiz plugin for WordPress versions up to, and including, 1.3.2.2 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with administrative privileges to inject arbitra...

MS Enterprise app management service RCE. CVE-2022-35841

TL;DR A remote command execution and local privilege escalation vulnerability has been fixed by Microsoft as part of September’s patch Tuesday. The vulnerability, filed under CVE-2022-35841, affects the Enterprise App Management Service which handles the installation of enterprise applications...

Design/Logic Flaw

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpspace.php appid parameter in a delete action...

CVE-2018-5375: Improper Neutralization of Input During Web Page Generation

Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecpspace.php appid parameter in a delete action...

PT-2018-16931

Name of the Vulnerable Software and Affected Versions DiscuzX version X3.4 Description The issue is related to a XSS problem. It occurs via the appid parameter in a delete action in the includespacecpspacecp space.php file. Recommendations For DiscuzX version X3.4, avoid using the appid parameter...

CVE-2018-5284

The ImageInject plugin 1.15 for WordPress has XSS via the flickrappid parameter to wp-admin/options-general.php...

PT-2018-16865

Name of the Vulnerable Software and Affected Versions ImageInject plugin version 1.15 Description The issue allows for XSS via the flickr appid parameter to the "/wp-admin/options-general.php" API endpoint. Recommendations For ImageInject plugin version 1.15, avoid using the flickr appid paramete...

CVE-2017-17870

The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action...

CVE-2017-17870

The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action...

CVE-2017-17870: Improper Neutralization of Special Elements used in an SQL Command

The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action...

CVE-2017-17870

CVE-2017-17870 affects the Joomla! JBuildozer extension version 1.4.1, where an SQL Injection occurs via the appid parameter in the entriessearch action. The vulnerability enables unauthenticated, network-based exploitation with high impact (C/H/I/A: High) as indicated in the CVSS metrics (CVSS v...

PT-2017-15059

Name of the Vulnerable Software and Affected Versions JBuildozer extension version 1.4.1 for Joomla! Description The issue concerns SQL Injection via the appid parameter in an "entriessearch" action. Recommendations For JBuildozer extension version 1.4.1, avoid using the appid parameter in the...

Joomla JBuildozer Component SQL Injection Vulnerability

Joomla! is a U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds, site search, etc. JBuildozer extension is used in one of the Joomla! Joomla JBuildozer component SQL injection vulnerability. A remote attacker can exploit this...

Microsoft Windows - Running Object Table Register ROTFLAGS_ALLOWANYCLIENT Privilege Escalation Explo

Exploit for windows platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1112 Windows: Running Object Table Register ROTFLAGSALLOWANYCLIENT EoP Platform: Windows 10 10586/14393 not tested 8.1 Update 2 or Windows 7 Class: Elevation of Privilege...

Information disclosure

GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to 1 data/users/.xml, 2 backups/users/.xml.bak, 3 data/other/authorization.xml, or 4 data/other/appid.xml...

Microsoft Windows - COM Session Moniker Privilege Escalation (MS17-012)

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1021 Windows: COM Session Moniker EoP Platform: Tested on Windows 10 14393, Server 2012 R2 Class: Elevation of Privilege Summary: When activating an object using the session moniker the DCOM activator doesn’t check if the current...

phpwind9.x 通讯秘钥安全漏洞

来源链接：phpwind 利用哈希长度扩展攻击进行getshell 一哥新发的漏洞，还是蛮屌的： http://www.wooyun.org/bugs/wooyun-2016-0210850。分析补丁（ http://www.phpwind.net/read/3709549 ）加上一些风闻，我得知利用的是哈希长度扩展攻击。之前CTF中经常出境的MD5 Length Extension Attack，终于在实战中露了一次面。 0x01 漏洞点分析 phpwind逻辑太冗杂了，一看就是java程序员开发的。...