CVE-2020-16629

CVE-2020-16629 affects PhpOK 5.4.137. A SQL injection vulnerability lets an attacker inject attachment data via SQL and then call the attachment replacement function via api.php to write a PHP file to a target path. The issue is documented across multiple sources (CNVD, NVD, Red Hat, CVE lists) w...

CVE-2020-16629

PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path...

Alt-N MDaemon Webmail 20.0.0 Cross Site Scripting

Exploit Title: Alt-N MDaemon webmail 20.0.0 - 'Contact name' Stored Cross Site Scripting XSS Date: 2020-08-25 Exploit Author: Kailash Bohara Vendor Homepage: https://www.altn.com/ Version: Mdaemon webmail 3. We can see execution code and after saving it, each time we visits the distribution list...

PHPOK SQL注入漏洞

phpok is a set of enterprise website system developed by Shenzhen锟絪 technology limited company using PHP+MYSQL language. PhpOK 5.4.137 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability by injecting attachment data via SQL and then calling the attachment...

JetBrains YouTrack Cross-Site Request Forgery Vulnerability (CNVD-2021-09316)

YouTrack is a keyboard-based issue and project tracking tool from the Czech company JetBrains, primarily used for tracking tasks and defect correction arrangements during development. A cross-site request forgery vulnerability exists in JetBrains YouTrack versions prior to 2020.4.4701. An attacke...

JetBrains YouTrack Attachment Operation Permission Check Improperly Vulnerability

YouTrack is a keyboard-based issue and project tracking tool from the Czech company JetBrains, primarily used for tracking tasks and defect correction arrangements during development. A vulnerability exists in JetBrains YouTrack versions prior to 2020.4.4701 due to improper checking of attachment...

CVE-2020-18723

Stored cross-site scripting XSS in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities...

CVE-2020-18723

Stored cross-site scripting XSS in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities...

Cross site scripting

Stored cross-site scripting XSS in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities...

CVE-2021-25768

In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly...

CVE-2021-25765

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible...

CVE-2021-25765

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible...

Cross site request forgery (csrf)

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible...

CVE-2021-25769

In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments...

Design/Logic Flaw

In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly...

Design/Logic Flaw

In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments...

CVE-2021-25769

In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments...

CVE-2021-25768

CVE-2021-25768 concerns JetBrains YouTrack prior to 2020.4.4701, where attachment operation permissions were checked improperly. The root cause is an incorrect permissions check on actions related to attachments, enabling potential access control weaknesses in that version range. Public reference...

CVE-2021-25768

In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly...

CVE-2021-25765

Summary: CVE-2021-25765 affects JetBrains YouTrack prior to 2020.4.4701 and is a CSRF vulnerability via attachment upload. Multiple sources (NVD, Red Hat, CNVD, CVE list, and JetBrains bulletin) corroborate that YouTrack versions before 2020.4.4701 are vulnerable. The issue enables cross-site req...