SQL Injection Vulnerability in Mini-Tmall Framework Front and Backend

Mini Tmall Mini Tmall is a Spring Boot-based integrated B2C e-commerce platform, the requirements of the design of the main reference Tmall shopping process: users start from registration, to complete the login, browse the products, add a shopping cart, place an order, confirm receipt, evaluation...

GHSA-65M9-M259-7JQW Improper Authorization in react-oauth-flow

All versions of react-oauth-flow fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials. Recommendation No fix ...

Heybbs micro community us***.php suffers from SQL injection vulnerability

Heybbs micro-community is a front-end based on bootstrap + jq + css, back-end php + mysql development of micro-community program. Heybbs micro-community us.php has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Ejucms front-end storage-type cross-site scripting vulnerability

Ejucms Real Estate System Ejucms is a localized O2O real estate website platform system. Hainan Ejucms Ejucms front-end storage-type cross-site scripting vulnerabilities. Attackers can use the vulnerability to obtain sensitive information such as administrator cookies...

Security Bulletin: CVE-2020-4202IBM UrbanCode Deploy (UCD) could allow an authenticated user to impersonate another user if the server is configured to enable Distributed Front End (DFE).

Summary IBM UrbanCode Deploy UCD could allow an authenticated user to impersonate another user if the server is configured to enable Distributed Front End DFE. Vulnerability Details CVEID: CVE-2020-4202 DESCRIPTION: IBM UrbanCode Deploy UCD could allow an authenticated user to impersonate another...

CVE-2020-14063

A stored Cross-Site Scripting XSS vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the...

Cross site scripting

A stored Cross-Site Scripting XSS vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the...

BugPoC: Improper use of "path" parameter can be used to trick testers into leaking their Front-End PoC

Summary: In https://bugpoc.com/testers/front-end, the populateFromFragment function incorrectly assigns hash parameter path to the subdomain element, allowing the "Test" functionality of the Front-End PoC Generator to open a popup on any domain instead of the expected web.bugpoc.ninja. It can be...

Microsoft Guidance for Enabling Request Smuggling Filter on IIS Servers

Executive Summary Microsoft is aware of a tampering vulnerability in the way that HTTP proxies front-end and web servers back-end that do not strictly adhere to RFC standards handle sequences of HTTP requests received from multiple sources. An attacker who successfully exploited the vulnerability...

Basecamp: HTTP request smuggling on Basecamp 2 allows web cache poisoning

It is found that an authenticated Basecamp 2 user can desync front and backend servers and poison the socket with harmful response for the next visitor. During redirect probe, It also appears that front-end infrastructure performs caching of content. Using HTTP request smuggling attack, It is...

SQL injection vulnerability in ECShop front-end fl***.php file at Merchant Pie Software Ltd.

ECShop is a B2C independent online store system, suitable for enterprises and individuals to quickly build a personalized online store, the system is based on PHP language and MYSQL database framework for the development of cross-platform open source program. ECShop front-end fl.php file SQL...

Cross site scripting

Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS in the web front end by leveraging the ability to create a custom field with a crafted field name...

Heybbs micro-community suffers from SQL injection vulnerability (CNVD-2020-45134)

Heybbs micro-community is a front-end based on bootstrap + jq + css, back-end php + mysql development of micro-community program. Heybbs Micro Community has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Logic flaw vulnerability in Heybbs micro-community

HEYBBS micro-community is a front-end based on bootstrap+jq+css, back-end php+mysql development of micro-community program. A logic flaw vulnerability exists in Heybbs Micro Community, which can be exploited by attackers to compromise confidentiality and integrity...

S.Siedle & Soehne SG 150-0 Smart Gateway Code Execution Vulnerability

S.Siedle & Soehne SG 150-0 Smart Gateway is a home smart gateway product from S.Siedle & Soehne, Germany. A security vulnerability exists in the S.Siedle & Soehne SG 150-0 Smart Gateway prior to version 1.2.4. The vulnerability can be exploited by an attacker to execute code via the backup functi...

Gira TKS-IP-Gateway Operating System Command Injection Vulnerability

Gira TKS-IP-Gateway is a network communication gateway product from Gira Germany. A security vulnerability exists in Gira TKS-IP-Gateway version 4.0.7.7. The vulnerability can be exploited by an attacker to execute code via the backup function of the web front-end...

Debian: Security Advisory (DLA-2196-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-4202

IBM UrbanCode Deploy UCD 7.0.3.0 and 7.0.4.0 could allow an authenticated user to impersonate another user if the server is configured to enable Distributed Front End DFE. IBM X-Force ID: 174955...

CVE-2020-4202

IBM UrbanCode Deploy UCD 7.0.3.0 and 7.0.4.0 could allow an authenticated user to impersonate another user if the server is configured to enable Distributed Front End DFE. IBM X-Force ID: 174955...

Code injection

IBM UrbanCode Deploy UCD 7.0.3.0 and 7.0.4.0 could allow an authenticated user to impersonate another user if the server is configured to enable Distributed Front End DFE. IBM X-Force ID: 174955...