PT-2020-14256 · Helm +2 · Helm +2

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 2.16.11 Helm versions prior to 3.3.2 Description: A Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attack...

Marked-tree path traversal vulnerability

Marked-tree is a Markdown viewer. A path traversal vulnerability exists in fs.readFile in the index.js file in marked-tree all versions, which stems from the program's failure to clean up paths, and can be exploited by an attacker to gain unauthorized access and overwrite or read arbitrary files...

GHSA-7PHR-5M9X-RW9Q Directory traversal in fast-http

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js...

CVE-2020-15081

In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possible workaround is to add an empty index.php file in the upload directory...

Monstra CMS Code Issue Vulnerability

Monstra CMS is a lightweight PHP-based content management system MS by Ukrainian software developer Sergey Romanenko. A security vulnerability exists in the index.php script in Monstra CMS version 3.0.4, which originates from the program's failure to properly validate file extensions. The...

CVE-2020-7603

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

CVE-2019-17635

Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicious version and the heap dump is reopened in Memory Analyzer. The user must chose to reopen an already parsed heap dump with an untrusted...

Deserialization of untrusted data

Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicious version and the heap dump is reopened in Memory Analyzer. The user must chose to reopen an already parsed heap dump with an untrusted...

CVE-2019-17635

Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicious version and the heap dump is reopened in Memory Analyzer. The user must chose to reopen an already parsed heap dump with an untrusted...

ClonOS WEB control panel cross-site scripting vulnerability

ClonOS is an open source platform based on FreeBSD. The platform is mainly used for the creation and management of virtual environments. web control panel is one of the web-based ClonOS control panel. A cross-site scripting vulnerability exists in the index.php file in the ClonOS WEB control pane...

CVE-2019-18419

A cross-site scripting XSS vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2019-18219

Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting XSS vulnerability, as it fails to validate user input. The affected components index.php, upgrade.php allow for JavaScript injection within both GET or POST requests, via a crafted URL or via the UpgradeMode POST parameter...

CVE-2019-15560

The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js...

CVE-2019-15132

Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of...

PrestaShop cross-site scripting vulnerability (CNVD-2019-16479)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A cross-site scripting vulnerability exists in the 'shopcountry' parameter of the...

CVE-2018-8099

Incorrect returning of an error code in the index.c:readentry function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository index file...

PT-2019-6068 · Wayang · Wayang-Cms

Name of the Vulnerable Software and Affected Versions: Wayang-CMS version 1.0 Description: A cross-site scripting XSS issue in the index.php file of Wayang-CMS allows attackers to execute arbitrary web scripts or HTML by adding a specially crafted X-Forwarded-For field to the header. This can...

PHP-Proxy Cross-Site Scripting Vulnerability

PHP-Proxy is a web-based proxy script featuring fast, easy customization and the ability to provide support for complex websites such as YouTube and Facebook. A cross-site scripting vulnerability exists in PHP-Proxy versions 5.1.0 and earlier, which can be exploited by an attacker via a URL field...

PhpTpoint Pharmacy Management System SQL Injection Vulnerability

PhpTpoint Pharmacy Management System is a pharmacy management system developed using the PHP language. A SQL injection vulnerability exists in the 'username' parameter of the index.php file in PhpTpoint Pharmacy Management System, which can be exploited by a remote attacker to bypass the login pa...

CVE-2018-18874

nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=filemanagerupload URI...