CVE-2022-31786: Improper Neutralization of Input During Web Page Generation

IdeaLMS 2022 allows reflected Cross Site Scripting XSS via the IdeaLMS/Class/Assessment/ PATHINFO...

XML External Entity Reference in drools

drools =7.59.x is affected by an XML External Entity XXE vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability...

CVE-2022-1642

A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mechanism offered by the Swift standard...

CVE-2021-41411

drools =7.59.x is affected by an XML External Entity XXE vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability...

CVE-2021-41411

drools =7.59.x is affected by an XML External Entity XXE vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability...

CVE-2021-41411

drools =7.59.x is affected by an XML External Entity XXE vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability...

drools 代码问题漏洞

drools is KIE open source a business rules management system . Open source rules engine, DMN engine and Complex Event Processing CEP engine for Java and JVM platforms. A security vulnerability exists in drools 7.59.x and earlier versions , the vulnerability stems from the Validator class in...

CVE-2021-41411: Improper Restriction of XML External Entity Reference

drools =7.59.x is affected by an XML External Entity XXE vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability...

CVE-2022-32301

YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib/Action/Home/ApiAction.class.php...

CVE-2022-32300

YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php...

CVE-2022-32301

YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib/Action/Home/ApiAction.class.php...

CVE-2022-32299

YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the id parameter at /App/Lib/Action/Admin/SiteAction.class.php...

CVE-2022-32300

YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php...

PT-2022-21217 · Unknown · Youdiancms

Name of the Vulnerable Software and Affected Versions: YoudianCMS version 9.5.0 Description: The issue is a SQL injection vulnerability. It occurs via the MailSendID parameter at the "/App/Lib/Action/Admin/MailAction.class.php" endpoint. Recommendations: For YoudianCMS version 9.5.0, consider...

YouDianCMS SQL注入漏洞

YouDianCMS is a website CMS. YoudianCMS version v9.5.0 suffers from a SQL injection vulnerability, which originates from the id parameter at /App/Lib/Action/Admin/SiteAction.class.php that lacks validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute...

YouDianCMS SQL注入漏洞

YouDianCMS is a website CMS. A SQL injection vulnerability exists in YoudianCMS v9.5.0, which originates from the lack of validation of the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php against external SQL input. This vulnerability can be exploited by attackers to execute...

YouDianCMS SQL注入漏洞

YouDianCMS is a website CMS. A SQL injection vulnerability exists in YouDianCMS v9.5.0, which originates from the lack of validation of the IdList parameter at /App/Lib/Action/Home/ApiAction.class.php against external SQL input. This vulnerability can be exploited to execute illegal SQL commands ...

CVE-2021-40604

A Server-Side Request Forgery SSRF vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated us...

CVE-2021-40604

CVE-2021-40604 affects IPS Community Suite prior to 4.6.2, where an SSRF vulnerability exists that can be triggered by remote authenticated users, with possible unauthenticated exploitation in some cases. The root cause involves dynamic class-name generation that can trigger deserialization via t...

Invision Community 代码问题漏洞

Invision Community is a software for designing and developing mobile application UI from Invision, Inc. A security vulnerability exists in Invision Community versions prior to 4.6.2 that originates from allowing a remote authenticated user to request arbitrary URLs or trigger deserialization via...