Design/Logic Flaw

An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files...

CVE-2022-23390

CVE-2022-23390 affects BBS Forum, where the vulnerability is in the getType function. Reports indicate that versions 5.3 and earlier are susceptible to arbitrary file uploads due to improper checks in the file handling logic. Affected product: BBS Forum (v5.3 and earlier). Impact: potential arbit...

CVE-2022-23390

An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files...

CVE-2022-23390

An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files...

Bbs Forum 代码问题漏洞

Bbs Forum Patrol Cloud Light Forum System is a forum system. A code issue vulnerability exists in BBS Forum, which originates from the product's getType function not performing security checks on uploaded files. An attacker can use this vulnerability to upload arbitrary files. The following...

Decryptor Keys Published for Maze, Egregor, Sekhmet Ransomwares

The shackles have been broken for victims of Maze/Egregor/Sekhmet ransomware: On Wednesday, decryption keys were released for all three ransomware strains in a forum post. The liberator, using the handle “Topleak,” described themselves as the developer of the three ransomwares. It’s been lovely,...

HYBBS 默认配置问题漏洞

HYBBS is a lightweight community forum program. A default configuration issue vulnerability exists in HYBBS, which stems from the product writing plugin-related configuration information to conf.php. An attacker can use this vulnerability to execute code on the Admin.php page. The following...

CVE-2022-23602

CVE-2022-23602 affects Nimforum prior to 2.2.0. A user can create a thread/post with an include pointing to a local file, causing Nimforum to render the file; this can also be triggered via the post preview endpoint. Consequence includes exposure of sensitive data such as forum.json secrets. Vers...

WordPress Asgaros Forum plugin <= 1.15.20 - Blind SQL Injection (SQLi) vulnerability

Blind SQL Injection SQLi vulnerability discovered by Krzysztof Zając in WordPress Asgaros Forum plugin versions = 1.15.20. Solution Update the WordPress Asgaros Forum plugin to the latest available version at least 2.0.0...

Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection

The plugin does not sanitise and escape the postid parameter before using it in a SQL statement via a REST route of the plugin accessible to any authenticated user, leading to a SQL injection PoC As any authenticated user, such as subscriber To get the nonce:...

Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection

The plugin does not sanitise and escape the postid parameter before using it in a SQL statement via a REST route of the plugin accessible to any authenticated user, leading to a SQL injection As any authenticated user, such as subscriber To get the nonce: /wp-admin/admin-ajax.php?action=rest-nonc...

Mageia: Security Advisory (MGASA-2014-0160)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2014-0379)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SSRF vulnerability in jupyter-server-proxy

Impact What kind of vulnerability is it? Server-Side Request Forgery SSRF Who is impacted? Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled. A lack of input validation allowed authenticated clients to proxy requests to other hosts, bypassing the allowedhos...

WordPress Asgaros Forum plugin SQL injection vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL.A SQL injection vulnerability exists in versions of the WordPress plugin Asgaros Forum prior to 1.15.15, which...

Uscat 跨站脚本漏洞

Uscat is a forum system based on Javaex + Ssm development. A cross-site scripting vulnerability exists in uscat, which stems from a cross-site scripting XSS vulnerability in the close registration information input box of uscat...

Uscat 跨站脚本漏洞

Uscat is a forum system based on Javaex + Ssm development. A cross-site scripting vulnerability exists in uscat, which stems from an input box via statistical code that is susceptible to cross-site scripting XSS attacks...

CVE-2021-25045

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forumid parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue...

CVE-2021-25045

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forumid parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue...

CVE-2021-25045

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forumid parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue...