ClassApps SelectSurvey.NET 安全漏洞

ClassApps SelectSurvey.Net is a survey software from ClassApps USA built using Microsoft's cutting-edge . A security vulnerability in the UploadedImageDisplay.aspx endpoint of ClassApps SelectSurvey.NET before 5.052.000 allows remote, unauthenticated attackers to retrieve survey user-submitted da...

CVE-2022-21673

Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token and no other user credentials will forward the OAuth Identity of the most recently...

SAP BusinessObjects Business Intelligence Platform 跨站脚本漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly and...

CVE-2021-42061: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Business Intelligence Platform Web Intelligence - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify...

Apache Ozone has an unspecified vulnerability (CNVD-2021-91624)

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. Apache Ozone version 1.2.0 has a security vulnerability that allows an attacker to retrieve token data from the database and use it...

CVE-2021-34684: Improper Neutralization of Special Elements used in an SQL Command

Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retrieve data from the related databases, as demonstrated by an api/repos/dashboards/editor URI...

Server-Side Request Forgery (SSRF) in zmister2016/mrdoc

Description ● SSRF in /uploaddocimg/, an attacker could abuse url to visit any intranet in the envioronment of MrDoc server, casuing breaking the border of network. ● Depending on the different env, it could leak sensitive meta-data，according to...

CVE-2020-19957

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dlprint.php page...

CVE-2020-19959

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dlsendmail.php page cookie...

CVE-2020-19960

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dlsendsms.php page cookie...

CVE-2020-19957

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dlprint.php page...

CVE-2020-19961

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php...

Sql injection

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php...

Sql injection

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dlprint.php page...

CVE-2020-19957

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dlprint.php page...

CVE-2020-19957

ZZCMS 2019 is affected by a SQL injection vulnerability in the /dl/dl_print.php page, exploitable via the id parameter to retrieve sensitive data. The root cause is missing validation of externally entered SQL statements in ZZCMS, leading to potential data leakage. Affected product/version: ZZCMS...

CVE-2020-19959

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dlsendmail.php page cookie...

CVE-2020-19959

CVE-2020-19959 affects ZZCMS 2019. A SQL injection in the /dl/dl_sendmail.php page cookie dlid parameter can allow an attacker to retrieve sensitive data. The issue is documented across multiple sources confirming the vulnerability in ZZCMS 2019 with SQLi via a cookie field; exploitation details ...

CVE-2020-19960

CVE-2020-19960 affects ZZCMS (version 2019). The vulnerability is a SQL injection that can exfiltrate sensitive data via the dlid parameter in the application’s PHP pages (e.g., /dl/dl_sendsms.php cookie; CNVD references /dl_print.php). Root cause appears to be insufficient validation/external in...

CVE-2020-19961: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php...