4801 matches found
CVE-2020-12606
An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xpcmdshell stored...
Sql injection
An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xpcmdshell stored...
SQL Injection Vulnerability in Ejucms Frontend of Hainan Ejucms Technology Co. Ltd (CNVD-2020-50722)
Ejucms Real Estate System Ejucms is a localized O2O real estate website platform system. Ltd. Ejucms front-end SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive database information...
Stored Cross-Site Scripting Vulnerability in RGCMS Frontend In***.php File
RuiGu information management system RGCMS is a set of open source building management system, using PHP language, written in the framework of Thinkphp5.1.+, the database using MYSQL database. RGCMS front In.php file exists stored cross-site scripting vulnerability. Attackers can use this...
Improper Input Validation
Overview solidusfrontend is a cart and storefront for the Solidus e-commerce project. Affected versions of this package are vulnerable to Improper Input Validation. It allows a malicious customer to craft request data with parameters that allow changing the address of the current order without...
SQL Injection Vulnerability in Dascommerce Mall System v2.0 Frontend
Big business mall system is a business creation network based on ten years of reconstruction of the e-commerce architecture, to create a set of operators, suppliers, purchasers, user distribution, etc., in the PC and mobile devices can be compatible with the operation of a complete set of offline...
GHSA-8M73-W2R2-6XXJ Insecure defaults in UmbracoForms
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...
Insecure defaults in UmbracoForms
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...
Hostmaster (Aegir) - Moderately critical - Access bypass, Arbitrary code execution - SA-CONTRIB-2020-031
Aegir is a powerful hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. Given that Aegir can use both Apache and Nginx Web servers, Apache allows configuration-writing users to escalate their privileges to the superuser root, and Aegir's operations...
CVE-2020-7685
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...
Default configuration
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...
CVE-2020-7685
CVE-2020-7685 affects UmbracoForms (all versions). The issue arises when using the default configuration for file uploads, which permits uploading arbitrary file types. A mitigation path is described: implement a custom workflow and frontend validation to block disallowed file types according to ...
CVE-2020-7685 Insecure Defaults
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...
[SECURITY] Fedora 31 Update: zabbix-4.0.22-1.fc31
Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechan ism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...
PT-2020-19708 · Umbraco · Umbraco Forms
Name of the Vulnerable Software and Affected Versions: UmbracoForms versions all versions Description: The issue allows uploading arbitrary file types when using the default configuration for upload forms. Users can mitigate this by creating a custom workflow and frontend validation to block...
[SECURITY] Fedora 32 Update: cacti-1.2.13-1.fc32
Cacti is a complete frontend to RRDTool. It stores all of the necessary information to create graphs and populate them with data in a MySQL database. The frontend is completely PHP driven...
Stored cross-site scripting vulnerability in hybbs frontend fr***.js file
hybbs is a PHP web program that supports plugin extensions and template extensions. A stored cross-site scripting vulnerability exists in the frontend fr.js file of hybbs. Attackers can use the vulnerability to obtain sensitive information such as user cookies...
Command execution vulnerability in PbootCMS frontend Pa***.php file
PbootCMS is an open source free PHP enterprise web development and construction management system. PbootCMS front Pa.php file has a command execution vulnerability. An attacker can exploit the vulnerability to execute arbitrary code...
SQL Injection Vulnerability in kkcms Frontend
kkcms is an open source video capture and playback system . The system is mainly used to automatically capture film and television resources and provide online playback capabilities. kkcms front-end SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive information i...