CVE-2021-27902

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads...

CVE-2021-27902

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads...

Cross site scripting

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads...

CVE-2021-27902

CVE-2021-27902 affects Craft CMS prior to 3.6.0. The connected documents describe a cross-site scripting (XSS) vulnerability in a front-end form that accepts user uploads. The root cause details and exploitation specifics are not provided in the documents. Scope is limited toCraft CMS versions be...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Craft CMS is a content management system for developers, designers and web professionals that provides flexibility, power and ease of use. A cross-site scripting vulnerability exists in a front-end form that accepts user uploads in versions of Craft CMS prior to 3.6.0. Detailed vulnerability...

RUSTSEC-2021-0081 Potential request smuggling capabilities due to lack of input validation

Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling HRS attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also...

Potential request smuggling capabilities due to lack of input validation

Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling HRS attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also...

Sql injection

FDCMS aka Fangfa Content Management System 4.0 contains a front-end SQL injection via Admin/Lib/Action/FloginAction.class.php...

Violation of implicit constraints in batched operations may break protocol assumptions

Handle 0xRajeev Vulnerability details Impact The Ladle batching of operations is a complex task as noted by the project lead which has implicit constraints on what operations can be bundled together in a batch, which operations can/have-to appear how many times and in what order/sequence etc. Som...

SQL Injection in akshayp282/quizx

✍️ Description Course deletion on the teacher portal is vulnerable to SQL injection. This will allow a user to run arbitrary SQL queries and completely erase, export or change all information in the database - potentially rendering the entire platform unusable. 🕵️‍♂️ Proof of Concept - Log in to...

OPENSUSE-SU-2021:0712-1 Security update for opera

This update for opera fixes the following issues: Update to version 76.0.4017.94 - released on the stable branch Update to version 76.0.4017.88 - CHR-8404 Update chromium on desktop-stable-90-4017 to 90.0.4430.85 - DNA-92219 Add bookmark API supports to the front-end - DNA-92409 MAC ‘Present now’...

Vaadin flow 安全漏洞

Vaadin flow is a software application. the Java framework for the Vaadin platform for building modern websites that look great, perform well and keep you and your users happy. A security vulnerability exists in vaadin that allows a local user to inject malicious code into front-end resources duri...

Unrestricted addLiquidity could cause unintended results on front-end apps that listen to events.

Handle shw Vulnerability details Impact The addLiquidity function in Pool.sol lacks an access control, which allows an attacker to add liquidity for any specific user. Front-end apps that listen to AddLiquidity events may be affected by this vulnerability and may go wrong since it is not the user...

Vaadin Designer Information Disclosure Vulnerability

Vaadin Designer is a visualization tool that enables you to drag and drop and configure web components on a canvas. A security vulnerability exists in Vaadin Designer versions 4.3.0 - 4.6.3. The vulnerability stems from an overly lax configuration of the front-end resource server. A remote attack...

Vaadin Designer 安全漏洞

Vaadin Designer is a visualization tool that enables you to drag and drop and configure web components on a canvas. A security vulnerability exists in Vaadin Designer versions 4.3.0 - 4.6.3. The vulnerability stems from an overly lax configuration of the front-end resource server. A remote attack...

Autechre RetroArch 命令注入漏洞

Autechre RetroArch is an application from Autechre open source. libretro API reference front-end. RetroArch suffers from a command injection vulnerability that allows an attacker to execute code on the file system...

Input validation

wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat when the user does not actively give...

SQL Injection Vulnerability in SemCms Frontend

SemCms is an open source foreign trade enterprise website management system, mainly used for foreign trade enterprises. SemCms front-end SQL injection vulnerability , attackers can use the vulnerability to obtain database sensitive information...

Command Execution Vulnerability in MCMS

MCMS is a development template based on SpringBoot 2 architecture , front-end based on vue, element ui . MCMS suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the web server...

Logic flaw vulnerability in oasys

oasys is an OA office automation system , the use of Maven for project management , springboot framework based on the development of the project , mysql underlying database , the front-end freemarker template engine , Bootstrap as the front-end UI framework , integrated jpa, mybatis and other...