502 matches found
CVE-2019-12903
CVE-2019-12903 affects Pydio Cells prior to 1.5.0. When a Name field is supplied in an unexpected Unicode format, the system mishandles the input and includes the database column/table name in the error message, leading to information disclosure. Practical impact: exposure of underlying database ...
CVE-2019-12903
Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pert of the error message, exposing sensitive information...
CVE-2019-12902
Pydio Cells vulnerable before version 1.5.0. The issue is incomplete cleanup of a user’s data on deletion, allowing a new user with the same User ID to recover the deleted user’s data. Affected platform: Pydio Cells prior to 1.5.0; root cause: data cleanup gap during deletion. Impact: potential i...
CVE-2019-12902
Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...
CVE-2019-12901
Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation...
CVE-2019-12901
Pydio Cells (before version 1.5.0) contains an input handling flaw where '../../' path elements are not neutralized, enabling a user with minimal privileges to upload or delete files in an unprivileged directory and thus escalate privileges. The issue is documented across multiple sources (NVD, R...
CVE-2019-12902: Incomplete Cleanup
Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...
CVE-2019-12903: Generation of Error Message Containing Sensitive Information
Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pert of the error message, exposing sensitive information...
CVE-2019-12901: Improper Limitation of a Pathname to a Restricted Directory
Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation...
CVE-2018-15755
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server...
CVE-2018-15755
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server...
CVE-2018-15755: Improper Neutralization of Special Elements used in an SQL Command
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server...
Description of the security update for Excel 2016: September 11, 2018
None None...
Cells Blog SQL Injection Vulnerability
Cells Blog is a free but powerful mini blogging system. Cells Blog 3.5 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability by using the pubreadpost.php ptid parameter to conduct a SQL injection attack...
Cells Blog Cross-Site Scripting Vulnerability (CNVD-2018-00086)
Cells Blog is a free but powerful mini blogging system. A cross-site scripting vulnerability exists in Cells Blog 3.5. An attacker can exploit this vulnerability via the pubreadpost.php fmid parameter to conduct a cross-site scripting attack...
Cells Blog Cross-Site Scripting Vulnerability
Cells Blog is a free but powerful mini blogging system. A cross-site scripting vulnerability exists in Cells Blog 3.5. An attacker can exploit this vulnerability by using the jfdname parameter in the act=showpic request to conduct a cross-site scripting attack...
CVE-2017-17950
Cells Blog 3.5 has SQL Injection via the pubreadpost.php ptid parameter...
CVE-2017-17949
Cells Blog 3.5 has XSS via the pubreadpost.php fmid parameter...