CVE-2019-15752

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restar...

CVE-2019-15752

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restar...

CVE-2019-12746

An issue was discovered in Open Ticket Request System OTRS Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be...

CVE-2019-12746

An issue was discovered in Open Ticket Request System OTRS Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be...

Design/Logic Flaw

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to...

Design/Logic Flaw

An issue was discovered in Open Ticket Request System OTRS Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be...

CVE-2019-13458

CVE-2019-13458 affects Open Ticket Request System (OTRS) and its Community Edition: 7.0.x (up to 7.0.8), 5.0.x (up to 5.0.36) and 6.0.x (up to 6.0.19). An attacker with an agent login and appropriate permissions can abuse OTRS notification tags in templates to disclose hashed user passwords. Publ...

CVE-2019-12746

CVE-2019-12746 affects Open Ticket Request System (OTRS) Community Edition: an agent login session ID could be disclosed by sharing a link to an embedded ticket article, enabling potential impersonation. Affected: OTRS 5.0.x up to 5.0.36 and 6.0.x up to 6.0.19. Impact: session impersonation risk ...

CVE-2019-12746

An issue was discovered in Open Ticket Request System OTRS Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be...

CVE-2019-11209

The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition 6.0.0; 6.0.1;...

Authorization Bypass

magento/community-edition is vulnerable to authorization bypass. The vulnerability exists as a user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially confidental information...

SQL Injection

magento/community-edition is vulnerable to SQL injection. The vulnerability exists as a user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications...

Information Disclosure

magento/community-edition is vulnerable to information disclosure. The vulnerability exists as the samples of disabled downloadable products are accessible due to the lack of user input sanitization...

Authorization Bypass

magento/community-edition is vulnerable to authorization bypass. The vulnerability exists as a low-privileged user to make unauthorized environment configuration changes...

Open-School 3.0 / Community Edition 2.3 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Open-School 3.0 / Community Edition 2.3 - Cross-Site Scripting Vulnerability Exploit Author: Greg.Priest Vendor Homepage: https://open-school.org/ Software Link: Version: Open-School 3.0/Community Edition 2.3 Tested on: Windows/Linux CVE :...

CVE-2019-14754

Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter...

CVE-2019-14754

Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter...

Sql injection

Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter...

CVE-2019-14754

Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter...

CVE-2019-14754

Open-School 3.0 and Community Edition 2.3 are affected by an SQL injection via index.php?r=students/students/document id parameter. The root cause is lack of validation of externally entered SQL statements in the database-based application, allowing an attacker to execute arbitrary SQL commands. ...