[SECURITY] Fedora 36 Update: golang-github-mrunalp-fileutils-0.5.0-5.fc36

Collection of utilities for file manipulation in Go...

CVE-2017-20125

A vulnerability classified as critical was found in Online Hotel Booking System Pro 1.2. Affected by this vulnerability is an unknown functionality of the file /roomtype-details.php. The manipulation of the argument tid leads to sql injection. The attack can be launched remotely. The exploit has...

CVE-2017-20117 TrueConf Server group DOM cross site scripting

A vulnerability was found in TrueConf Server 4.3.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/group. The manipulation leads to basic cross site scripting DOM. The attack can be launched remotely. The exploit has been disclos...

CVE-2017-20101 ProjectSend information disclosure

A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zipdownload. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely...

Schneider Electric IGSS Data Server Access Control Error Vulnerability (CNVD-2023-38195)

The Schneider Electric IGSS Data Server is a data server for the interactive graphical Scada system from Schneider Electric, France. An Access Control Error vulnerability exists in Schneider Electric IGSS Data Server versions prior to 15.0.0.22140, which stems from the application's lack of...

CVE-2017-20077

A vulnerability was found in Hindu Matrimonial Script. It has been rated as critical. This issue affects some unknown processing of the file /admin/successstory.php. The manipulation leads to improper privilege management. The attack may be initiated remotely. The exploit has been disclosed to th...

Design/Logic Flaw

A vulnerability was found in Hindu Matrimonial Script. It has been rated as critical. This issue affects some unknown processing of the file /admin/successstory.php. The manipulation leads to improper privilege management. The attack may be initiated remotely. The exploit has been disclosed to th...

CVE-2022-32240

SAP 3D Visual Enterprise Viewer is affected by CVE-2022-32240 when a user opens manipulated Jupiter Tessellation (.jt, JTReader.x3d) files from untrusted sources. Public docs describe a crash that makes the application temporarily unavailable until restart. The ZDI advisory additionally notes a r...

CVE-2022-32240

When a user opens manipulated Jupiter Tesselation .jt, JTReader.x3d files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application...

CVE-2022-32236

SAP 3D Visual Enterprise Viewer is affected by CVE-2022-32236 via parsing manipulated Windows Bitmap BMP and related 2d.x3d inputs from untrusted sources. The issue, documented by ZDI as a BMP parsing out-of-bounds write enabling remote code execution, can crash the application or allow code exec...

PT-2022-3203 · Unknown · Igss Data Server

Name of the Vulnerable Software and Affected Versions: IGSS Data Server versions prior to V15.0.0.22170 Description: The issue is related to a missing authentication procedure for critical functions in the IGSS Data Server, part of the Interactive Graphical SCADA System. This could allow a remote...

CVE-2018-25034

A vulnerability, which was classified as problematic, has been found in Thomson TCW710 ST5D.10.05. This issue affects some unknown processing of the file /goform/wlanPrimaryNetwork. The manipulation of the argument ServiceSetIdentifier with the input alert1 as part of POST Request leads to basic...

CVE-2017-20029

A vulnerability was found in PHPList 3.2.6 and classified as critical. This issue affects some unknown processing of the file /lists/index.php of the component Edit Subscription. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the...

CVE-2017-20033 PHPList Reflected cross site scriting

A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argument page with the input send'";alert8 leads to cross site scripting Reflected. It is possible to initiate the attack remotely. Upgrading...

CVE-2020-36542 Demokratian install3.php privileges management

A vulnerability classified as critical has been found in Demokratian. This affects an unknown part of the file install/install3.php. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is...

CVE-2022-1980

A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been rated as problematic. This issue affects the file /admin/?page=systeminfo/contactinfo. The manipulation of the textbox Telephone with the input alert1 leads to cross site scripting. The attack may be initiated...

CVE-2021-26633

SQL injection and Local File Inclusion LFI vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulnerabilities can be exploited by manipulating a variable with a desired value and inserting and arbitrary file...

Path Traversal

firefox is vulnerable to Path Traversal. A remote attacker is able to use the % character in filenames to store the data outside of the intended directory using windows environment variables, such as %HOMEPATH% or %APPDATA%...

XXE vulnerability in NUnit Plugin

NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. This allows a user able to control the input files for its post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins...

GHSA-H377-287M-W2R9 Drupal file REST resource does not properly validate

In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services rest module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or...